Cross-site Scripting Vulnerability in Drupal Leaflet Plugin

CVE-2026-107265

What is CVE-2026-107265?

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Leaflet plugin, which permits malicious users to inject arbitrary scripts into web pages. This flaw stems from improper input neutralization during web page generation, allowing attackers to execute scripts in the context of a victim’s browser session. Versions from 0.0.0 to 10.4.13 are affected, posing a significant security risk for websites using this plugin. It is crucial for site administrators to apply the necessary patches to mitigate this vulnerability.

References