CVE-2025-12369
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker with Contributor-level access can perform an XSS attack, potentially leading to session theft, administrator account takeover, or website content modification.
Recommendation
Update the Extensions for Leaflet Map plugin to a version later than 4.7. Consider restricting the ability to add shortcodes for low-privileged users.
Other vulnerabilities in Extensions for Leaflet Map
See all- CVE-2026-57380High
The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.
- CVE-2025-66093Medium
The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
Original NVD description (English source)
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS