Leaflet Map Extensions CVE-2026-114703

Exploitation requires an authenticated account on the target WordPress site with sufficient capability to submit content through the Extensions for Leaflet Map plugin (reflected by PR:L), plus a victim who subsequently views the page containing the stored payload (reflected by UI:R). The specific plugin input field or map parameter that is improperly neutralized is not detailed in the available sources. Limiting factors that reduce realistic risk: the attacker cannot be fully unauthenticated, the malicious content only triggers when another user renders the affected page, and impact is bounded to the victim's browser session rather than direct server compromise.

This is a stored Cross-Site Scripting (CWE-79) flaw in the 'Extensions for Leaflet Map' WordPress plugin, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vector indicates a network-reachable but authenticated issue: PR:L means an attacker must already hold a low-privileged account, and UI:R means a victim must view the injected content for the payload to fire - both of which constrain real-world exploitability. The scope change (S:C) reflects that the injected script executes in a victim's browser rather than solely within the vulnerable server component, which is typical of stored XSS. On exploitation signals: there is no CISA KEV listing, no EPSS score was supplied, and no public exploit or PoC reference is present in the input, so there is no evidence of active exploitation or available weaponized code. The vuln.today decision label is 'this_month', consistent with a Medium-severity, authenticated, user-interaction-dependent issue rather than an emergency. Net assessment: a genuine but second-tier priority - real enough to patch in a normal maintenance cycle, but not a drop-everything issue given the authentication and user-interaction requirements and the absence of any exploitation evidence. Note the single-source nature of this data (one Patchstack advisory): affected-version and fix details should be confirmed with the vendor.

An attacker who holds a low-privileged authenticated account on a WordPress site (e.g., a contributor or author) submits a Leaflet map entry containing a malicious script payload through a plugin input field that is not properly neutralized. The payload is stored and later rendered when an administrator or other user views the affected page, executing attacker-controlled JavaScript in that victim's authenticated browser session. No public exploit code or PoC reference was identified in the provided data.