Live › vulnerability › CVE-2026-114703
Go to dashboardThe Extensions for Leaflet Map WordPress plugin, by hupe13, does not neutralize some input before writing it into web pages, so stored script can be injected. An attacker who can submit that input can run JavaScript in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Extensions for Leaflet Map plugin at version 6.0 or earlier are in scope, as the description lists 'n/a through 6.0'. Sites that do not have this plugin installed can skip it; the sources do not say which roles can submit the vulnerable input.
No product ranges from the sources yet.
extensions-leaflet-map in the WordPress admin plugins list or with wp plugin get extensions-leaflet-map --field=versionextensions-leaflet-map to a version later than 6.0, once the vendor publishes one; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114703")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.