Stored Cross-Site Scripting Vulnerability in Extensions for Leaflet Map Plugin

CVE-2026-5451

What is CVE-2026-5451?

The Extensions for Leaflet Map plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to inject malicious scripts via the 'elevation-track' shortcode. This issue stems from inadequate sanitization and escaping of user-supplied attributes, potentially leading to execution of harmful web scripts on the affected pages whenever a user accesses them. It is crucial for site administrators to update the plugin and implement security best practices to mitigate these risks.

References