EXTENSIONS-LEAFLET-MAP · CVE-2026-125794 · Package
NO FIX YET
The Extension for Leaflet Map WordPress plugin by hupe13 has a stored cross-site scripting flaw affecting versions up to and including 6.1.1. An attacker who can store input in the plugin can run scripts in other users' browsers.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Extension for Leaflet Map WordPress plugin at version 6.1.1 or earlier are affected, since the flaw is in stored input handling. The sources do not say which user roles can store the malicious input. Sites without this plugin can skip it.
Not affected if plugin-not-installed
Who cares leaflet-map, wordpress
6.1.1 or earlier.No fix yet, per the sources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.