PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114703 hupe13 CVE debrief

A Cross Site Scripting (XSS) vulnerability exists in the WordPress Extensions for Leaflet Map plugin versions up to 6.0. This issue allows for Stored XSS, potentially impacting users who interact with affected pages. The vulnerability's impact requires verification from official sources, and its full scope is currently unknown. Defenders should assess exposure and prioritize patching or mitigation. The CVE record and source item provide details on the vulnerability, including its existence in plugin versions up to 6.0 and its classification as a Stored XSS vulnerability.

Vendor
hupe13
Product
Extensions for Leaflet Map
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for WordPress installations, particularly those using the Extensions for Leaflet Map plugin, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-114703 is a Stored XSS vulnerability in the WordPress Extensions for Leaflet Map plugin versions up to 6.0. Defenders should prioritize patching and implement mitigations to prevent potential XSS attacks. The vulnerability's impact requires verification from official sources, and its full scope is currently unknown.

  • User interaction with affected pages may lead to malicious script execution.
  • Successful exploitation could result in unauthorized actions within the WordPress context.
  • Defenders must verify plugin versions and apply patches to mitigate potential attacks.
  • Further analysis is required to determine the full scope of impact and affected versions.

Technical summary

The Extensions for Leaflet Map plugin for WordPress has a Stored Cross Site Scripting (XSS) vulnerability in versions up to 6.0. This vulnerability is due to improper neutralization of input during web page generation. The vulnerability allows for Stored XSS, potentially impacting users who interact with affected pages. Defenders should prioritize verifying plugin versions and applying patches or workarounds to mitigate potential XSS attacks.

Defensive priority

Defenders should prioritize verifying plugin versions and applying patches or workarounds to mitigate potential XSS attacks.

Recommended defensive actions

  • Verify the version of the Extensions for Leaflet Map plugin and update to a patched version if available.
  • Implement Content Security Policy (CSP) headers to help mitigate XSS attacks.
  • Monitor plugin and WordPress core updates for security patches.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in plugin versions up to 6.0 and its classification as a Stored XSS vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114703 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114703

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114703 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114703

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.