The vulnerability is a DOM‑based cross‑site scripting flaw that allows an attacker to inject malicious scripts into web pages generated by the plugin. Affects the user experience, potentially enabling theft of session cookies, defacement of the site, or navigation to malicious resources through a malicious script embedded in page content or URLs.

WordPress sites using the hupe13 "Extensions for Leaflet Map" plugin with a version of 4.8 or earlier are affected. No specific sub‑version details are provided, so all releases up to and including 4.8 should be considered vulnerable.

The CVSS score of 6.5 indicates moderate severity. EPSS below 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user to visit a specially crafted page or URL constructed by the attacker, indicating that it is unauthenticated and relies on user interaction or a malicious link. Once triggered, the injected script executes in the context of the victim’s browser, potentially compromising confidentiality, integrity, and availability of the site.