CVE-2025-12369

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>Extends the WordPress Plugin <a href="https://wordpress.org/plugins/leaflet-map/" rel="ugc">Leaflet Map</a> with Leaflet Plugins and other functions.</p> <h3>Functions</h3> <ul> <li> <p>Create an elevation chart profile of a track. There are also acceleration, slope, speed and tempo chart profiles. You can also place multiple tracks on one map.</p> </li> <li> <p>By default Leaflet Map uses tiles from openstreetmap.org or from the tile servers you configured. You can use more and switch between them.</p> </li> <li> <p>Many markers on a map become confusing. You can cluster and shape them.</p> </li> <li> <p>You can use Awesome markers.</p> </li> <li> <p>You can group the elements on the map by criteria and show/hide them.</p> </li> <li> <p>Create a &#8220;featured map&#8221;.</p> </li> <li> <p>Create an overview map with geo-locations provided in the pages and posts.</p> </li> <li> <p>Get a tooltip when hovering over an element.</p> </li> <li> <p>You can design a choropleth map.</p> </li> <li> <p>You can display the map in fullscreen mode.</p> </li> <li> <p>Reset the map.</p> </li> <li> <p>Gesture handling</p> </li> <li> <p>Manage your files for Leaflet Map.</p> </li> <li> <p>Help to migrate from <a href="https://wordpress.org/plugins/wp-gpx-maps/" rel="ugc">WP GPX Maps</a>.</p> </li> <li> <p>and more functions.</p> </li> </ul> <h3>Included Leaflet Plugins</h3> <h4>Leaflet Plugins</h4> <ul> <li><a href="https://github.com/Raruto/leaflet-elevation" rel="nofollow ugc">leaflet-elevation</a>: A Leaflet plugin that allows to add elevation profiles using d3js.</li> <li><a href="https://github.com/makinacorpus/Leaflet.GeometryUtil" rel="nofollow ugc">Leaflet.GeometryUtil</a></li> <li><a href="https://github.com/yohanboniface/Leaflet.i18n" rel="nofollow ugc">Leaflet.i18n</a>: Internationalisation module for Leaflet plugins.</li> <li><a href="https://github.com/Raruto/leaflet-rotate" rel="nofollow ugc">leaflet-rotate</a>: A Leaflet plugin that allows to add rotation functionality to map tiles</li> <li><a href="https://github.com/makinacorpus/Leaflet.AlmostOver" rel="nofollow ugc">Leaflet.AlmostOver</a>: This plugin allows to detect mouse click and overing events on lines, with a tolerance distance.</li> <li><a href="https://www.npmjs.com/package/@tmcw/togeojson" rel="nofollow ugc">@tmcw/togeojson</a>: Convert KML, GPX, and TCX to GeoJSON.</li> <li><a href="https://github.com/d3/d3" rel="nofollow ugc">D3</a>: Data-Driven Documents</li> <li><a href="https://github.com/leaflet-extras/leaflet-providers" rel="nofollow ugc">Leaflet-providers</a>: An extension that contains configurations for various tile providers.</li> <li><a href="https://github.com/dayjournal/Leaflet.Control.Opacity" rel="nofollow ugc">Leaflet.Control.Opacity</a>: Makes multiple tile layers transparent.</li> <li><a href="https://github.com/Leaflet/Leaflet.markercluster" rel="nofollow ugc">Leaflet.markercluster</a>: Provides Beautiful Animated Marker Clustering functionality.</li> <li><a href="https://github.com/adammertel/Leaflet.MarkerCluster.PlacementStrategies" rel="nofollow ugc">Leaflet.MarkerCluster.PlacementStrategies</a>: Styling Markerclusters.</li> <li><a href="https://github.com/coryasilva/Leaflet.ExtraMarkers" rel="nofollow ugc">Leaflet.ExtraMarkers</a>: Shameless copy of Awesome-Markers with more shapes and colors.</li> <li><a href="https://github.com/hupe13/leaflet-list-markers" rel="nofollow ugc">Leaflet List Markers</a>: A Leaflet Control for listing visible markers in the map.</li> <li><a href="https://github.com/ghybs/Leaflet.FeatureGroup.SubGroup" rel="nofollow ugc">Leaflet.FeatureGroup.SubGroup</a>: Grouping of Leaflet elements by options and features.</li> <li><a href="https://github.com/jjimenezshaw/Leaflet.Control.Layers.Tree" rel="nofollow ugc">Leaflet.Control.Layers.Tree</a>: A Tree Layers Control for Leaflet.</li> <li><a href="https://github.com/stefanocudini/leaflet-search" rel="nofollow ugc">Leaflet Control Search</a>: Search Markers/Features location by option or custom property.</li> <li><a href="https://github.com/timwis/leaflet-choropleth" rel="nofollow ugc">leaflet-choropleth</a>: Choropleth plugin for Leaflet (color scale based on value).</li> <li><a href="https://github.com/torfsen/leaflet.zoomhome" rel="nofollow ugc">leaflet.zoomhome</a>: Provides a zoom control with a &#8220;Home&#8221; button to reset the view.</li> <li><a href="https://github.com/brunob/leaflet.fullscreen" rel="nofollow ugc">leaflet.fullscreen</a>: Simple plugin for Leaflet that adds fullscreen button to your maps.</li> <li><a href="https://github.com/Raruto/leaflet-gesture-handling" rel="nofollow ugc">Leaflet.GestureHandling</a>: A Leaflet plugin that allows to prevent default map scroll/touch behaviours.</li> <li><a href="https://github.com/Turfjs/turf" rel="nofollow ugc">turf</a>: Advanced geospatial analysis for browsers and Node.js</li> </ul> <h4>Included Font</h4> <ul> <li><a href="https://fontawesome.com/download" rel="nofollow ugc">Font Awesome 6</a></li> </ul> <h4>Documentation</h4> <p>Detailed documentation and examples in <a href="https://leafext.de/" rel="nofollow ugc">German</a> and <a href="https://leafext.de/en/" rel="nofollow ugc">English</a>.</p> <h4>Thank you</h4> <p>Many thanks to everyone who found errors and provided ideas for new functions.</p>
WordPress Plugin DirectoryWordPress Plugin Directory
87.8K