The Extensions for Leaflet Map plugin implements improper neutralization of user input during web page generation, leading to a Stored XSS vulnerability. An attacker who can inject content into the plugin’s configuration or content fields can embed malicious JavaScript that will run in the context of any user who views the affected page. This flaw could be used to deface a site, steal session cookies, or execute further attacks against site users. The weakness is classified as CWE‑79.

The vulnerability affects the hupe13 Extensions for Leaflet Map plugin for WordPress versions from the initial release up through 6.0 inclusive. Administrators of sites using any supported version of the plugin should verify the installed version. In the absence of a patch, disabling plugin features that accept untrusted input can mitigate the risk.

The CVSS score of 6.5 indicates medium severity, but the absence of an EPSS score means there is insufficient data to gauge current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, and no official workaround is provided. Attackers could exploit it remotely by supplying malicious payloads through the plugin’s input fields, which will be stored and later rendered to site visitors. The risk multiplies if the plugin is exposed to authenticated editors or administrators who can supply the injection.