EUVD-2026-62200
GHSA-4h7g-5542-v3fc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Edit permission is required so PR:L; stored XSS needs a victim to view the page (UI:R) and executes in their browser beyond the wiki component (S:C) with typical session-scoped C:L/I:L.
Primary rating from Vendor (https://github.com/ProfessionalWiki/Maps).
CVSS VectorVendor: https://github.com/ProfessionalWiki/Maps
Lifecycle Timeline
3DescriptionCVE.org
Summary
Stored XSS through wikitext can be performed by inserting malicious HTML into the overlays parameter of the display_map parser function when using the leaflet service.
Details
The maps extension doesn't escape overlay names before passing them to leaflet. Leaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243
PoC
Preview the following wikitext, using the default configuration options of the extension:
{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.<img src=x onerror="alert(1);">}}Impact
Stored XSS can be performed by any user with the edit permission.
AnalysisAI
Stored cross-site scripting in the MediaWiki Maps extension before version 12.1.3 allows users with edit permission to inject malicious HTML via the overlays parameter of the display_map parser function when using the Leaflet service. The injected JavaScript executes in the browsers of site visitors who view the crafted page, potentially leading to session hijacking or other browser-based attacks. A public proof-of-concept is available, but active exploitation has not been reported.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today