The vulnerability is a stored cross‑site scripting flaw in the Leaflet service of the ProfessionalWiki Maps extension. The display_map parser accepts attacker‑controlled HTML in the overlays parameter, and the overlay name is used directly as a Leaflet layer‑control label without escaping. This allows a wiki user with edit permission to store malicious wikitext that, when another user previews or views the map, executes embedded script in the viewing user's browser, giving the attacker the same privileges as the victim, such as accessing session data or performing authenticated actions.

Affected installations are running the ProfessionalWiki Maps extension before version 12.1.3 on MediaWiki. The flaw is exposed in the display_map parser within the Leaflet service; any wiki that enables this extension and uses the overlays parameter in map pages is vulnerable.

The flaw is scored with a CVSS of 8.6, indicating high severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Because the affected users must possess edit rights to inject the payload, the attack vector is a local stored XSS that requires an attacker to have a trusted editing role, but once the payload is stored, any user who views the map can be victimized. The exploit can lead to execution of arbitrary scripts with the victim’s session rights, posing a significant confidentiality and integrity risk.