CVE-2026-5451

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>Extends the WordPress Plugin <a href="https://wordpress.org/plugins/leaflet-map/" rel="ugc">Leaflet Map</a> with Leaflet Plugins and other functions.</p> <h3>Functions</h3> <ul> <li> <p>Create an elevation chart profile of a track. There are also acceleration, slope, speed and tempo chart profiles. You can also place multiple tracks on one map.</p> </li> <li> <p>By default Leaflet Map uses tiles from openstreetmap.org or from the tile servers you configured. You can use more and switch between them.</p> </li> <li> <p>Many markers on a map become confusing. You can cluster and shape them.</p> </li> <li> <p>You can use Awesome markers.</p> </li> <li> <p>You can group the elements on the map by criteria and show/hide them.</p> </li> <li> <p>Create a &#8220;featured map&#8221;.</p> </li> <li> <p>Create an overview map with geo-locations provided in the pages and posts.</p> </li> <li> <p>Get a tooltip when hovering over an element.</p> </li> <li> <p>You can design a choropleth map.</p> </li> <li> <p>You can display the map in fullscreen mode.</p> </li> <li> <p>Reset the map.</p> </li> <li> <p>Gesture handling</p> </li> <li> <p>Manage your files for Leaflet Map.</p> </li> <li> <p>Help to migrate from <a href="https://wordpress.org/plugins/wp-gpx-maps/" rel="ugc">WP GPX Maps</a>.</p> </li> <li> <p>and more functions.</p> </li> </ul> <h3>Included Leaflet Plugins</h3> <h4>Leaflet Plugins</h4> <ul> <li><a href="https://github.com/Raruto/leaflet-elevation" rel="nofollow ugc">leaflet-elevation</a>: A Leaflet plugin that allows to add elevation profiles using d3js.</li> <li><a href="https://github.com/makinacorpus/Leaflet.GeometryUtil" rel="nofollow ugc">Leaflet.GeometryUtil</a></li> <li><a href="https://github.com/yohanboniface/Leaflet.i18n" rel="nofollow ugc">Leaflet.i18n</a>: Internationalisation module for Leaflet plugins.</li> <li><a href="https://github.com/Raruto/leaflet-rotate" rel="nofollow ugc">leaflet-rotate</a>: A Leaflet plugin that allows to add rotation functionality to map tiles</li> <li><a href="https://github.com/makinacorpus/Leaflet.AlmostOver" rel="nofollow ugc">Leaflet.AlmostOver</a>: This plugin allows to detect mouse click and overing events on lines, with a tolerance distance.</li> <li><a href="https://www.npmjs.com/package/@tmcw/togeojson" rel="nofollow ugc">@tmcw/togeojson</a>: Convert KML, GPX, and TCX to GeoJSON.</li> <li><a href="https://github.com/d3/d3" rel="nofollow ugc">D3</a>: Data-Driven Documents</li> <li><a href="https://github.com/leaflet-extras/leaflet-providers" rel="nofollow ugc">Leaflet-providers</a>: An extension that contains configurations for various tile providers.</li> <li><a href="https://github.com/dayjournal/Leaflet.Control.Opacity" rel="nofollow ugc">Leaflet.Control.Opacity</a>: Makes multiple tile layers transparent.</li> <li><a href="https://github.com/Leaflet/Leaflet.markercluster" rel="nofollow ugc">Leaflet.markercluster</a>: Provides Beautiful Animated Marker Clustering functionality.</li> <li><a href="https://github.com/adammertel/Leaflet.MarkerCluster.PlacementStrategies" rel="nofollow ugc">Leaflet.MarkerCluster.PlacementStrategies</a>: Styling Markerclusters.</li> <li><a href="https://github.com/coryasilva/Leaflet.ExtraMarkers" rel="nofollow ugc">Leaflet.ExtraMarkers</a>: Shameless copy of Awesome-Markers with more shapes and colors.</li> <li><a href="https://github.com/hupe13/leaflet-list-markers" rel="nofollow ugc">Leaflet List Markers</a>: A Leaflet Control for listing visible markers in the map.</li> <li><a href="https://github.com/ghybs/Leaflet.FeatureGroup.SubGroup" rel="nofollow ugc">Leaflet.FeatureGroup.SubGroup</a>: Grouping of Leaflet elements by options and features.</li> <li><a href="https://github.com/jjimenezshaw/Leaflet.Control.Layers.Tree" rel="nofollow ugc">Leaflet.Control.Layers.Tree</a>: A Tree Layers Control for Leaflet.</li> <li><a href="https://github.com/stefanocudini/leaflet-search" rel="nofollow ugc">Leaflet Control Search</a>: Search Markers/Features location by option or custom property.</li> <li><a href="https://github.com/timwis/leaflet-choropleth" rel="nofollow ugc">leaflet-choropleth</a>: Choropleth plugin for Leaflet (color scale based on value).</li> <li><a href="https://github.com/torfsen/leaflet.zoomhome" rel="nofollow ugc">leaflet.zoomhome</a>: Provides a zoom control with a &#8220;Home&#8221; button to reset the view.</li> <li><a href="https://github.com/brunob/leaflet.fullscreen" rel="nofollow ugc">leaflet.fullscreen</a>: Simple plugin for Leaflet that adds fullscreen button to your maps.</li> <li><a href="https://github.com/Raruto/leaflet-gesture-handling" rel="nofollow ugc">Leaflet.GestureHandling</a>: A Leaflet plugin that allows to prevent default map scroll/touch behaviours.</li> <li><a href="https://github.com/Turfjs/turf" rel="nofollow ugc">turf</a>: Advanced geospatial analysis for browsers and Node.js</li> </ul> <h4>Included Font</h4> <ul> <li><a href="https://fontawesome.com/download" rel="nofollow ugc">Font Awesome 6</a></li> </ul> <h4>Documentation</h4> <p>Detailed documentation and examples in <a href="https://leafext.de/" rel="nofollow ugc">German</a> and <a href="https://leafext.de/en/" rel="nofollow ugc">English</a>.</p> <h4>Thank you</h4> <p>Many thanks to everyone who found errors and provided ideas for new functions.</p>
WordPress Plugin DirectoryWordPress Plugin Directory
87.8K