Stored DOM-Based Cross-Site Scripting in Extensions for Leaflet Map Plugin by WordPress

CVE-2026-103485

What is CVE-2026-103485?

The Extensions for Leaflet Map plugin for WordPress is susceptible to Stored DOM-Based Cross-Site Scripting. This vulnerability arises from inadequate input sanitization and output escaping within the 'feature.properties[]' parameter. Attackers can exploit this flaw by injecting malicious web scripts, which execute when a user accesses the compromised pages. Successful exploitation typically involves an attacker prompting a site administrator to configure a public map using specific shortcode combinations, pointing to a controlled GeoJSON source. Such a scenario enables an attacker to manipulate external data hosts or perform subdomain takeovers, leading to severe security risks for affected WordPress sites.

References