Live › vulnerability › CVE-2026-103485
The Extensions for Leaflet Map plugin for WordPress up to and including 5.4 fails to sanitize a GeoJSON feature property, so injected script can run in pages that show a configured map. An unauthenticated attacker who controls the GeoJSON source URL can make the script run in visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Sites running the Extensions for Leaflet Map plugin at version 5.4 or earlier that publish a public map using the leaflet-map, leaflet-geojson and choropleth shortcodes with a GeoJSON source URL that an attacker could control, such as a compromised external data host, a dangling subdomain, or an attacker-hosted feed. Sites without the plugin, without this shortcode combination, or whose GeoJSON sources are all hosts they control are not exposed.
No product ranges from the sources yet.
5.4 or earlier.[leaflet-map] shortcode combined with [leaflet-geojson] and [choropleth], and check whether the GeoJSON src points to a host you do not control.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example, through compromise of an external data host, a subdomain takeover, or a site intentionally pointing at an attacker-hosted feed.
This page as .md · .json · in your agent: get_signal("CVE-2026-103485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.