EUVD-2026-43453Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered DOM XSS needs no privileges in the vulnerable app but requires victim interaction (UI:R) and executes in the browser (S:C) with low CIA impact; PR:N assumed but possibly PR:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 5.1.
AnalysisAI
Stored/DOM-based cross-site scripting in the hupe13 "Extensions for Leaflet Map" WordPress plugin (all versions up to and including 5.1) lets an attacker inject script that executes in a victim's browser when they load a page rendering the crafted map content. Reported by Patchstack and carrying a 7.1 CVSS with a scope-changed vector, it requires victim interaction and yields limited confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a page rendering the plugin's Leaflet map output includes attacker-controlled input, and that a victim actively loads that page (UI:R) for the injected DOM script to execute in their browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L describes network-reachable, low-complexity exploitation with no privileges but mandatory user interaction, a changed scope (the injected script executes in the victim's browser session rather than the vulnerable server), and low impact across CIA - consistent with a typical XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts map content or a shortcode parameter containing a malicious script payload that the plugin writes into the page DOM unsanitized; when a victim loads the affected page, the script runs in their browser session and can steal cookies, perform actions as the victim, or redirect them. Because the vector requires user interaction (UI:R) and low complexity, the realistic delivery is luring a logged-in user or administrator to view the poisoned page. … |
| Remediation | No vendor-released patch version is identified in the supplied data; the advisory only specifies affected versions through 5.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress sites running the Extensions for Leaflet Map plugin and document which versions are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Extensions For Leaflet Map
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today