What is the CVSS score of CVE-2026-5451?

CVE-2026-5451 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5451

EUVD-2026-20645 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-f684-x2p3-9qp3

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 20:46 euvd

EUVD-2026-20645

Analysis Generated

Apr 08, 2026 - 20:46 vuln.today

CVE Published

Apr 08, 2026 - 20:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Extensions for Leaflet Map plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'elevation-track' shortcode due to insufficient input sanitization and output escaping, enabling arbitrary script execution whenever users access injected pages. The vulnerability affects all versions up to and including 4.14, with a CVSS score of 6.4 reflecting the moderate but significant impact across multiple users of the same WordPress installation.

Technical ContextAI

The vulnerability exists in the handling of the 'elevation-track' shortcode within the Extensions for Leaflet Map plugin (cpe:2.3:a:hupe13:extensions_for_leaflet_map:*:*:*:*:*:*:*:*). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from the plugin's failure to properly sanitize user-supplied shortcode attributes before storing them in the database and to escape them during output rendering. Code references in the plugin's multielevation.php (line 227) and functions.php (line 168) indicate that the shortcode processor directly passes user-controlled input into page rendering without applying WordPress security functions such as sanitize_text_field() during input or wp_kses_post() during output. This allows malicious JavaScript to persist in the database and execute in the context of any user viewing the affected page.

RemediationAI

Users should upgrade the Extensions for Leaflet Map plugin to a version newer than 4.14 as soon as available. The affected code in multielevation.php and functions.php requires input sanitization (using WordPress functions such as sanitize_text_field() or sanitize_textarea_field()) at the point of shortcode attribute processing and output escaping (using esc_attr() for HTML attributes or esc_html() for text content) at the point of rendering. Until a patched version is released, site administrators should restrict Contributor-level access to only trusted users, disable the 'elevation-track' shortcode if not actively used, or consider using an alternative mapping plugin. Refer to the WordPress plugin repository (https://wordpress.org/plugins/extensions-leaflet-map/) and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=cve) for updates.