EUVD-2026-16106Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the leafext-cookie-time and leafext-delete-cookie shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (unset, before, after). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
This is a Stored Cross-Site Scripting (XSS) vulnerability in the DSGVO Snippet for Leaflet Map and its Extensions WordPress plugin (all versions up to and including 3.1) that allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript code into pages via the leafext-cookie-time and leafext-delete-cookie shortcodes. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes (unset, before, after), enabling script execution whenever visitors access the compromised pages. With a CVSS score of 6.4 and attack complexity of low, this represents a moderate but real threat in WordPress environments where multiple content contributors exist.
Technical ContextAI
The vulnerability exists in the WordPress plugin codebase as identified through CPE string cpe:2.3:a:hupe13:dsgvo_snippet_for_leaflet_map_and_its_extensions, specifically within the shortcode handler implementations in php/time-delete.php (line 35 and surrounding code as evidenced by the WordPress plugin repository references). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The plugin processes shortcode attributes without proper sanitization before database storage (leading to Stored XSS rather than Reflected XSS) and fails to escape output when rendering these attributes back to the front-end. This is a classic input-validation and output-encoding gap in WordPress plugin development where shortcode callbacks must both sanitize inputs at registration time and escape outputs at render time.
RemediationAI
Immediately upgrade the DSGVO Snippet for Leaflet Map and its Extensions plugin to version 3.2 or later, which contains patches for the shortcode attribute sanitization and escaping issues. The patch changeset is available in the WordPress plugin repository trunk and can be reviewed at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489426%40dsgvo-leaflet-map%2Ftrunk&old=3488424%40dsgvo-leaflet-map%2Ftrunk. As an interim mitigation before patching, administrators should restrict contributor-level access to only trusted users, audit existing pages and posts for suspicious content in the leafext-cookie-time and leafext-delete-cookie shortcodes, and consider disabling these shortcodes if not actively used. Additionally, implement WordPress security hardening practices such as limiting plugin updates to administrators and enabling security monitoring via Wordfence or equivalent solutions.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today