CVE-2025-66093
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
Risk Assessment
This can lead to session theft, administrator account takeover, or website content modification. The risk affects organizations using this plugin on WordPress sites.
Recommendation
Update the Extensions for Leaflet Map plugin to the latest version (above 4.8) or disable it if an update is not available.
Other vulnerabilities in Extensions for Leaflet Map
See all- CVE-2026-57380High
The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.
- CVE-2025-12369Medium
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 4.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS