Extensions for Leaflet Map CVE-2026-57380

Exploitation requires that a page rendering the plugin's Leaflet map output includes attacker-controlled input, and that a victim actively loads that page (UI:R) for the injected DOM script to execute in their browser. Limiting factors: the payload only fires when someone visits the crafted map page, the impact is confined to the victim's browser session (low confidentiality/integrity/availability), and - despite the PR:N CVSS - Patchstack WordPress plugin XSS findings commonly require at least contributor/author-level access to inject the content, so the true prerequisite may be an authenticated low-privilege account rather than a fully anonymous attacker; confirm against the vendor advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L describes network-reachable, low-complexity exploitation with no privileges but mandatory user interaction, a changed scope (the injected script executes in the victim's browser session rather than the vulnerable server), and low impact across CIA - consistent with a typical XSS. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability signals cannot be cross-referenced; the risk rests on the CVSS profile alone. This is a moderate-priority issue: XSS is genuinely exploitable but bounded by the UI:R requirement and low technical impact, so it is not a drop-everything network-worm scenario. Note a common ambiguity for WordPress plugin XSS: Patchstack advisories frequently require an authenticated contributor/author role to inject the payload, which the PR:N vector does not reflect - verify the actual privilege prerequisite against the Patchstack advisory before treating this as fully unauthenticated.

An attacker crafts map content or a shortcode parameter containing a malicious script payload that the plugin writes into the page DOM unsanitized; when a victim loads the affected page, the script runs in their browser session and can steal cookies, perform actions as the victim, or redirect them. Because the vector requires user interaction (UI:R) and low complexity, the realistic delivery is luring a logged-in user or administrator to view the poisoned page. No public proof-of-concept was provided in the intelligence sources.