The vulnerability is a stored cross‑site scripting flaw in the Leaflet service of the ProfessionalWiki Maps extension. It allows a wiki user with edit permission to store malicious HTML through the overlays parameter in the display_map parser function. When another user previews or views the map, the embedded script executes in their browser, giving the attacker the same privileges as the viewing user, such as accessing session data or performing authenticated actions.

Affected installations are running the ProfessionalWiki Maps extension before version 12.1.3 on MediaWiki. The flaw is exposed in the display_map parser within the Leaflet service; any wiki that enables this extension and uses the overlays parameter in map pages is vulnerable.

The flaw is scored with a CVSS of 8.6, indicating high severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Because the affected users must possess edit rights to inject the payload, the attack vector is a local stored XSS that requires an attacker to have a trusted editing role, but once the payload is stored, any user who views the map can be victimized. The exploit can lead to execution of arbitrary scripts with the victim’s session rights, posing a significant confidentiality and integrity risk.