What is the CVSS score of CVE-2026-57380?

CVE-2026-57380 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Extensions for Leaflet Map are affected by CVE-2026-57380?

A stored cross-site scripting vulnerability in the Extensions for Leaflet Map WordPress plugin (versions up to 5.1) allows attackers to inject malicious scripts that execute in the browsers of all…

How to fix or mitigate CVE-2026-57380?

Within 24 hours, identify all WordPress sites running the Extensions for Leaflet Map plugin and document which versions are deployed. Within 7 days, disable the plugin on all non-critical installations and implement compensating controls on critical deployments including strict input validation and output encoding of map parameters. Within 30 days, monitor the plugin vendor's advisory channels for security updates to version 5.1 and later, establish a testing and rapid-deployment plan for any patch release, and evaluate alternative map plugins with demonstrated security track records.

Extensions for Leaflet Map CVE-2026-57380

EUVD-2026-43453 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Extensions For Leaflet Map Wordpress Plugin Hupe13

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered DOM XSS needs no privileges in the vulnerable app but requires victim interaction (UI:R) and executes in the browser (S:C) with low CIA impact; PR:N assumed but possibly PR:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:05 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 5.1.

AnalysisAI

Stored/DOM-based cross-site scripting in the hupe13 "Extensions for Leaflet Map" WordPress plugin (all versions up to and including 5.1) lets an attacker inject script that executes in a victim's browser when they load a page rendering the crafted map content. Reported by Patchstack and carrying a 7.1 CVSS with a scope-changed vector, it requires victim interaction and yields limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin that extends the Leaflet.js mapping library (an open-source JavaScript library for interactive maps) with additional shortcodes and display features. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically a DOM-based variant where untrusted input is written into the page's DOM by client-side JavaScript without proper encoding, so the browser interprets attacker-controlled data as executable script. The single affected CPE is cpe:2.3:a:hupe13:extensions_for_leaflet_map:*:*:*:*:*:*:*:* covering all versions through 5.1.

RemediationAI

No vendor-released patch version is identified in the supplied data; the advisory only specifies affected versions through 5.1. Administrators should monitor the plugin's WordPress.org page and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/extensions-leaflet-map/vulnerability/wordpress-extensions-for-leaflet-map-plugin-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve) and upgrade to the first release above 5.1 as soon as it is published. Until a fixed version is confirmed, compensating controls include deploying a Web Application Firewall or the Patchstack virtual patch to filter XSS payloads targeting the plugin's map shortcodes, restricting who can author or edit posts/pages that embed Leaflet map content to trusted users only, and adding a restrictive Content-Security-Policy header to limit inline script execution - noting that a strict CSP can break other plugins or themes that rely on inline scripts and should be tested in staging first. If the plugin is non-essential, deactivating and removing it fully eliminates the exposure at the cost of losing the extended map functionality.