---
id: "CVE-2026-114703"
kind: "vulnerability"
aliases: ["CVE-2026-114703"]
title: "Leaflet Map WordPress extension: stored XSS through input handling"
severity: "medium"
cvss: 6.5
epss: 0.0013
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T09:17:16+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:47:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114703", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114703", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Leaflet Map WordPress extension: stored XSS through input handling

The Extensions for Leaflet Map WordPress plugin, by hupe13, does not neutralize some input before writing it into web pages, so stored script can be injected. An attacker who can submit that input can run JavaScript in the browser of anyone who views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of `extensions-leaflet-map` in the WordPress admin plugins list or with `wp plugin get extensions-leaflet-map --field=version`
- unknown whether the sources name the exact input field or shortcode affected

## Fix

- Update `extensions-leaflet-map` to a version later than `6.0`, once the vendor publishes one; the sources do not name a fixed version
- unknown whether a patched release exists yet

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114703
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114703

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_