Extensions for Leaflet Map vulnerabilities

The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.

The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.