Dsgvo Snippet For Leaflet Map And Its Extensions
Monthly
This is a Stored Cross-Site Scripting (XSS) vulnerability in the DSGVO Snippet for Leaflet Map and its Extensions WordPress plugin (all versions up to and including 3.1) that allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript code into pages via the `leafext-cookie-time` and `leafext-delete-cookie` shortcodes. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes (`unset`, `before`, `after`), enabling script execution whenever visitors access the compromised pages. With a CVSS score of 6.4 and attack complexity of low, this represents a moderate but real threat in WordPress environments where multiple content contributors exist.
This is a Stored Cross-Site Scripting (XSS) vulnerability in the DSGVO Snippet for Leaflet Map and its Extensions WordPress plugin (all versions up to and including 3.1) that allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript code into pages via the `leafext-cookie-time` and `leafext-delete-cookie` shortcodes. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes (`unset`, `before`, `after`), enabling script execution whenever visitors access the compromised pages. With a CVSS score of 6.4 and attack complexity of low, this represents a moderate but real threat in WordPress environments where multiple content contributors exist.