CVE-2026-52854

🗓️ 18 Aug 2026 21:32:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 119 Views🌐 WEB

Maps extension display_map overlays parameter allows stored XSS in Leaflet layer-control labels before 12.1.3.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-52854	2 Jul 202618:35	–	circl
Cvelist	CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function	18 Aug 202621:32	–	cvelist
EUVD	EUVD-2026-62200	18 Aug 202621:32	–	euvd
Github Security Blog	mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function	2 Jul 202617:51	–	github
Mend	CVE-2026-52854	18 Aug 202621:32	–	mend
NVD	CVE-2026-52854	18 Aug 202622:16	–	nvd
osv_ghsa	GHSA-4H7G-5542-V3FC mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function	2 Jul 202617:51	–	osv_ghsa
osv_ubuntu	UBUNTU-CVE-2026-52854	18 Aug 202622:16	–	osv_ubuntu
Positive Technologies	PT-2026-55481	2 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-52854: Improper Neutralization of Input During Web Page Generation	18 Aug 202600:00	–	rapid7

[
  {
    "vendor": "ProfessionalWiki",
    "product": "Maps",
    "versions": [
      {
        "version": "< 12.1.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ProfessionalWiki/Maps/releases/tag/12.1.3
github	www.github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md
github	www.github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc
github	www.github.com/ProfessionalWiki/Maps/pull/899
github	www.github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806

Parameter	Position	Path	Description	CWE
overlays	query param	/display_map	The display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, which is then rendered without proper escaping in the client-side javascript.	CWE-79, CWE-80

22 Oct 2026 17:09Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.6

EPSS0.00578

SSVC