{"id":"CVE-2026-125794","kind":"vulnerability","aliases":["CVE-2026-125794"],"related":[],"title":"WordPress Leaflet Map extension: stored XSS lets attackers inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.","summary":"The Extension for Leaflet Map WordPress plugin by hupe13 has a stored cross-site scripting flaw affecting versions up to and including 6.1.1. An attacker who can store input in the plugin can run scripts in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"extensions-leaflet-map","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["leaflet-map","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Extension for Leaflet Map (extensions-leaflet-map) in the WordPress plugins screen or the plugin's readme.\n- Confirm whether the installed version is `6.1.1` or earlier.","fix":null,"status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:51+00:00","updated_at":"2026-11-13T15:48:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Leaflet Map extension: stored XSS lets attackers inject scripts","impact":"medium","summary":"The Extension for Leaflet Map WordPress plugin by hupe13 has a stored cross-site scripting flaw affecting versions up to and including 6.1.1. An attacker who can store input in the plugin can run scripts in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","leaflet-map"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' or admins' browsers on the site","analyst_note":"Confirm the fixed version and the required privilege to store input at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125794 or the plugin's WordPress.org changelog.","how_to_check":"- Check the installed version of Extension for Leaflet Map (extensions-leaflet-map) in the WordPress plugins screen or the plugin's readme.\n- Confirm whether the installed version is `6.1.1` or earlier.","plain_action":"","product_name":"extensions-leaflet-map","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Extension for Leaflet Map WordPress plugin at version 6.1.1 or earlier are affected, since the flaw is in stored input handling. The sources do not say which user roles can store the malicious input. Sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4559,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125794':13A,16A '-2026':12A,15A '6.1.1':49B,101C 'affect':43B,93C 'allow':89C 'attack':8A,51B 'browser':65B 'cross':39B,75C 'cross-sit':38B,74C 'cve':11A,14A 'extens':4A,27B,81C,86C,94C 'extensions':18A 'extensions-leaflet-map':17A,85C 'flaw':42B 'generat':73C 'hupe13':34B,80C 'improp':66C 'includ':48B 'inject':9A 'input':55B,69C 'issu':92C 'leaflet':2A,19A,22B,29B,83C,87C,96C 'leaflet-map':21B 'let':7A 'map':3A,20A,23B,30B,84C,88C,97C 'n/a':99C 'neutral':67C 'packag':24B 'page':72C 'plugin':32B,58B 'run':60B 'script':10A,41B,61B,77C 'site':40B,76C 'store':5A,37B,54B,90C 'user':64B 'version':44B 'vulner':78C 'web':71C 'wordpress':1A,25B,31B 'xss':6A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Extension for Leaflet Map WordPress plugin at version 6.1.1 or earlier are affected, since the flaw is in stored input handling. The sources do not say which user roles can store the malicious input. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["extensionsleafletmap"],"ptokens":["extensions","leaflet","map"],"labels":["leafletmap","medium","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-125794':13A,16A '-2026':12A,15A 'attack':8A 'cve':11A,14A 'extens':4A 'extensions':18A 'extensions-leaflet-map':17A 'inject':9A 'leaflet':2A,19A 'let':7A 'map':3A,20A 'script':10A 'store':5A 'wordpress':1A 'xss':6A","search_b":"'6.1.1':49B 'affect':43B 'attack':51B 'browser':65B 'cross':39B 'cross-sit':38B 'extens':27B 'flaw':42B 'hupe13':34B 'includ':48B 'input':55B 'leaflet':22B,29B 'leaflet-map':21B 'map':23B,30B 'packag':24B 'plugin':32B,58B 'run':60B 'script':41B,61B 'site':40B 'store':37B,54B 'user':64B 'version':44B 'wordpress':25B,31B","search_c":"'6.1.1':101C 'affect':93C 'allow':89C 'cross':75C 'cross-sit':74C 'extens':81C,86C,94C 'extensions-leaflet-map':85C 'generat':73C 'hupe13':80C 'improp':66C 'input':69C 'issu':92C 'leaflet':83C,87C,96C 'map':84C,88C,97C 'n/a':99C 'neutral':67C 'page':72C 'script':77C 'site':76C 'store':90C 'vulner':78C 'web':71C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125794","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}