CVE-2026-125794: WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerability

Q: Who needs to be authenticated to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and must interact with a user (UI:R). The vulnerability is remotely reachable over the network (AV:N) with low attack complexity (AC:L).

Q: What impact can successful exploitation have?

Successful exploitation can result in stored cross-site scripting. The provided CVSS metrics indicate low confidentiality, integrity, and availability impact, with scope changed (S:C).

Q: Which plugin versions are affected?

Extension for Leaflet Map versions through 6.1.1 are affected. The provided data does not identify a fixed version.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.

Affected Software

1 affected component

hupe13 Extension for Leaflet Map<=6.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade extensions-leaflet-map to a version that resolves this vulnerability.
Fixed in 6.1.2

Event History

Nov 13, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who needs to be authenticated to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and must interact with a user (UI:R). The vulnerability is remotely reachable over the network (AV:N) with low attack complexity (AC:L).

What impact can successful exploitation have?