The Extensions for Leaflet Map WordPress plugin is vulnerable to stored cross‑site scripting because the 'elevation-track' shortcode does not properly sanitize or escape user‑supplied attributes. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript into the shortcode, which is then saved to the database. When any visitor loads a page containing the malicious shortcode, the injected script executes in the visitor's browser, allowing the attacker to steal credentials, hijack sessions, or perform unauthorized actions.

Affected product is the Extensions for Leaflet Map plugin, version 4.14 or earlier, maintained by hupe13. The plugin is available through the official WordPress plugin repository and is used to embed Leaflet maps with elevation tracks on WordPress sites.

The CVSS score of 6.4 indicates moderate severity. Because the flaw is exploitable via normal WordPress editing workflows—an attacker only needs Contributor role privileges to embed the malicious shortcode—the likelihood of exploitation is significant for sites that have upgraded or left the plugin at an affected version. EPSS data is unavailable and the vulnerability has not been reported in the CISA KEV catalog, but the potential impact and ease of exploitation warrant urgent remediation.