{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5451", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-02T22:04:55.446Z", "datePublished": "2026-04-08T20:25:09.844Z", "dateUpdated": "2026-04-09T17:53:32.804Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T20:25:09.844Z"}, "affected": [{"vendor": "hupe13", "product": "Extensions for Leaflet Map", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=cve"}, {"url": "https://wordpress.org/plugins/extensions-leaflet-map"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/multielevation.php#L227"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/functions.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/multielevation.php?rev=3500851"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/functions.php?rev=3500851"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-02-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-04-02T22:20:48.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-02T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T17:53:03.489623Z", "id": "CVE-2026-5451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:53:32.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T17:53:03.489623Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:53:21.497Z"}}], "cna": {"title": "Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hupe13", "product": "Extensions for Leaflet Map", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-04-02T22:20:48.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-02T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=cve"}, {"url": "https://wordpress.org/plugins/extensions-leaflet-map"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/multielevation.php#L227"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/functions.php#L168"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/multielevation.php?rev=3500851"}, {"url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/functions.php?rev=3500851"}], "descriptions": [{"lang": "en", "value": "The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T20:25:09.844Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5451", "state": "PUBLISHED", "dateUpdated": "2026-04-09T17:53:32.804Z", "dateReserved": "2026-04-02T22:04:55.446Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T20:25:09.844Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-5451", "lastModified": "2026-04-24T18:04:28.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-08T21:17:01.837", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/functions.php#L168"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.11/php/multielevation.php#L227"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/functions.php?rev=3500851"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/4.15/php/multielevation.php?rev=3500851"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/extensions-leaflet-map"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.14]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Extensions for Leaflet Map", "source": "cna", "vendor": "hupe13"}, "product": "extensions_for_leaflet_map", "vendor": "hupe13"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T21:21:59.403694+00:00", "value": {"mitigation_remediation": ["Update the Extensions for Leaflet Map plugin to version 4.15 or later.", "If an immediate update is not possible, deactivate or uninstall the plugin to prevent further exploitation.", "After updating, review all posts, pages, and custom content for any elevation-track shortcodes containing malicious attributes and remove them.", "Verify that only trusted users have Contributor or higher roles and restrict their ability to insert shortcodes if appropriate."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via plugin shortcode"}, "threat_synthesis": {"affected_systems": "Affected product is the Extensions for Leaflet Map plugin, version 4.14 or earlier, maintained by hupe13. The plugin is available through the official WordPress plugin repository and is used to embed Leaflet maps with elevation tracks on WordPress sites.", "description_and_impact": "The Extensions for Leaflet Map WordPress plugin is vulnerable to stored cross\u2011site scripting because the 'elevation-track' shortcode does not properly sanitize or escape user\u2011supplied attributes. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript into the shortcode, which is then saved to the database. When any visitor loads a page containing the malicious shortcode, the injected script executes in the visitor's browser, allowing the attacker to steal credentials, hijack sessions, or perform unauthorized actions.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. Because the flaw is exploitable via normal WordPress editing workflows\u2014an attacker only needs Contributor role privileges to embed the malicious shortcode\u2014the likelihood of exploitation is significant for sites that have upgraded or left the plugin at an affected version. EPSS data is unavailable and the vulnerability has not been reported in the CISA KEV catalog, but the potential impact and ease of exploitation warrant urgent remediation."}}}}, "created": "2026-04-09T08:17:57.739804+00:00", "updated": "2026-04-09T08:27:21.078180+00:00", "vendors": ["hupe13", "hupe13$PRODUCT$extensions_for_leaflet_map", "wordpress", "wordpress$PRODUCT$wordpress"]}