CVE-2026-114703

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to and including 5.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a site administrator to have previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is controlled by the attacker.

The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.

The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.