Extensions For Leaflet Map
Monthly
Stored/DOM-based cross-site scripting in the hupe13 "Extensions for Leaflet Map" WordPress plugin (all versions up to and including 5.1) lets an attacker inject script that executes in a victim's browser when they load a page rendering the crafted map content. Reported by Patchstack and carrying a 7.1 CVSS with a scope-changed vector, it requires victim interaction and yields limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored DOM-based cross-site scripting in the Extensions for Leaflet Map WordPress plugin through 5.4 lets unauthenticated attackers place script in a choropleth map's feature.properties template value, which then executes in visitors' browsers when the public map page is viewed. The flaw is tightly gated: an administrator must already have published a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination, and that map's GeoJSON src must point to a feed the attacker controls or can influence, such as through external host compromise, subdomain takeover, or an intentionally attacker-hosted feed. No public exploit has been identified at time of analysis; the CVSS 5.4 score and AC:H rating reflect these configuration and data-source-control prerequisites.
Stored Cross-Site Scripting in Extensions for Leaflet Map plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'elevation-track' shortcode due to insufficient input sanitization and output escaping, enabling arbitrary script execution whenever users access injected pages. The vulnerability affects all versions up to and including 4.14, with a CVSS score of 6.4 reflecting the moderate but significant impact across multiple users of the same WordPress installation.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored/DOM-based cross-site scripting in the hupe13 "Extensions for Leaflet Map" WordPress plugin (all versions up to and including 5.1) lets an attacker inject script that executes in a victim's browser when they load a page rendering the crafted map content. Reported by Patchstack and carrying a 7.1 CVSS with a scope-changed vector, it requires victim interaction and yields limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored DOM-based cross-site scripting in the Extensions for Leaflet Map WordPress plugin through 5.4 lets unauthenticated attackers place script in a choropleth map's feature.properties template value, which then executes in visitors' browsers when the public map page is viewed. The flaw is tightly gated: an administrator must already have published a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination, and that map's GeoJSON src must point to a feed the attacker controls or can influence, such as through external host compromise, subdomain takeover, or an intentionally attacker-hosted feed. No public exploit has been identified at time of analysis; the CVSS 5.4 score and AC:H rating reflect these configuration and data-source-control prerequisites.
Stored Cross-Site Scripting in Extensions for Leaflet Map plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'elevation-track' shortcode due to insufficient input sanitization and output escaping, enabling arbitrary script execution whenever users access injected pages. The vulnerability affects all versions up to and including 4.14, with a CVSS score of 6.4 reflecting the moderate but significant impact across multiple users of the same WordPress installation.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.