{"id":"CVE-2026-114703","kind":"vulnerability","aliases":["CVE-2026-114703"],"related":[],"title":"Leaflet Map WordPress extension: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0.","summary":"The Extensions for Leaflet Map WordPress plugin, by hupe13, does not neutralize some input before writing it into web pages, so stored script can be injected. An attacker who can submit that input can run JavaScript in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of `extensions-leaflet-map` in the WordPress admin plugins list or with `wp plugin get extensions-leaflet-map --field=version`\n- unknown whether the sources name the exact input field or shortcode affected","fix":"- Update `extensions-leaflet-map` to a version later than `6.0`, once the vendor publishes one; the sources do not name a fixed version\n- unknown whether a patched release exists yet","status":"open","published_at":"2026-10-22T09:17:16+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:24+00:00","updated_at":"2026-10-25T03:47:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update `extensions-leaflet-map` to a version later than `6.0`, once the vendor publishes one; the sources do not name a fixed version\n- unknown whether a patched release exists yet","reach":"internet","title":"Leaflet Map WordPress extension: stored XSS through input handling","impact":"medium","summary":"The Extensions for Leaflet Map WordPress plugin, by hupe13, does not neutralize some input before writing it into web pages, so stored script can be injected. An attacker who can submit that input can run JavaScript in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Stored script runs in visitors' browsers, potentially hijacking admin sessions","analyst_note":"Confirm the vulnerable input, the required privilege level and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114703.","how_to_check":"- Check the installed plugin version of `extensions-leaflet-map` in the WordPress admin plugins list or with `wp plugin get extensions-leaflet-map --field=version`\n- unknown whether the sources name the exact input field or shortcode affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Extensions for Leaflet Map plugin at version 6.0 or earlier are in scope, as the description lists 'n/a through 6.0'. Sites that do not have this plugin installed can skip it; the sources do not say which roles can submit the vulnerable input.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3363,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114703':12A,15A '-2026':11A,14A '6.0':105C 'affect':68B,97C 'allow':93C 'anyon':64B 'attack':51B 'browser':62B 'cross':79C 'cross-sit':78C 'cve':10A,13A 'extens':4A,25B,85C,90C,98C 'extensions-leaflet-map':89C 'generat':77C 'handl':9A 'host':19B 'hupe13':32B,84C 'improp':70C 'inject':49B 'input':8A,37B,56B,73C 'issu':96C 'javascript':59B 'leaflet':1A,27B,87C,91C,100C 'map':2A,28B,88C,92C,101C 'n/a':103C 'neutral':35B,71C 'packag':16B 'page':43B,69B,76C 'plugin':23B,30B 'run':58B 'script':46B,81C 'self':18B 'self-host':17B 'site':80C 'store':5A,45B,94C 'submit':54B 'view':66B 'vulner':82C 'web':42B,75C 'wordpress':3A,20B,22B,29B 'wordpress-plugin':21B 'write':39B 'xss':6A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Extensions for Leaflet Map plugin at version 6.0 or earlier are in scope, as the description lists 'n/a through 6.0'. Sites that do not have this plugin installed can skip it; the sources do not say which roles can submit the vulnerable input.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114703","severity":null,"published_at":"2026-10-22T09:17:16+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114703","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114703","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}