The vulnerability allows a stored cross‑site scripting attack through the ‘url’ parameter of the Map Block Leaflet WordPress plugin. Insufficient input sanitization and output escaping enable authenticated users with Contributor or higher privileges to inject malicious JavaScript that executes in the browsers of any visitor to the affected page. The weakness is a classic example of a client‑side injection flaw, classified as CWE‑79.

All installations of the Map Block Leaflet plugin up to and including version 3.2.1 are affected. The plugin is distributed by goiblas for WordPress sites. No other vendors or products are mentioned in the CNA data.

The CVSS score of 6.4 indicates a medium‑severity flaw, while the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Because only authenticated users with Contributor‑level access can inject the payload, the attack vector is limited to authenticated usage rather than remote or unauthenticated exploitation. Successful exploitation would allow an attacker to compromise the confidentiality, integrity, and availability of the user experience for all visitors who view the infected page.