CVE-2026-114703: WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this vulnerability?

An attacker needs low-level privileges and must persuade a user to interact with malicious content. The attack can be performed remotely over the network.

Q: What is the potential impact?

Successful exploitation allows stored cross-site scripting and can affect confidentiality, integrity, and availability at a low level. The scope may extend beyond the vulnerable plugin's security authority.

Q: Which plugin versions are affected?

Extensions for Leaflet Map versions through 6.0 are affected. No fixed version is provided in the available data.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0.

Affected Software

1 affected component

hupe13 Extensions for Leaflet Map<=6.0

Event History

Oct 22, 2026

CVE Published

via MITRE·08:59 AM

Data Sourced

via MITRE·08:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs low-level privileges and must persuade a user to interact with malicious content. The attack can be performed remotely over the network.

What is the potential impact?

Successful exploitation allows stored cross-site scripting and can affect confidentiality, integrity, and availability at a low level. The scope may extend beyond the vulnerable plugin's security authority.

Which plugin versions are affected?