CVE-2025-12369 Extensions for Leaflet Map <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the geojsonmarker shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for...

CVE-2025-12369

The CVE-2025-12369 entry concerns WordPress plugin Extensions for Leaflet Map (

WordPress plugin Extensions for Leaflet Map 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin Extensions for Leaflet Map suffers from a cross-site scripting vulnerability...

PT-2025-44948

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the geojsonmarker shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for...

EUVD-2012-2893

Malware in sbrugna...

EUVD-2021-11379

Malware in sbrugna...

EUVD-2023-35403

Malicious code in bioql PyPI...

EUVD-2025-5599

Malicious code in bioql PyPI...

EUVD-2023-57393

Malicious code in bioql PyPI...

EUVD-2022-24466

Malicious code in bioql PyPI...

EUVD-2024-37620

Malicious code in bioql PyPI...

EUVD-2022-52001

Malicious code in bioql PyPI...

EUVD-2024-32245

Malicious code in bioql PyPI...

Malicious code in loclys-leaflet-routing-machine (npm)

The package loclys-leaflet-routing-machine was found to contain malicious code...

MAL-2025-25498 Malicious code in loclys-leaflet-routing-machine (npm)

The package loclys-leaflet-routing-machine was found to contain malicious code...

CVE-2025-5122

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5122 Map Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5122

CVE-2025-5122 maps to Map Block Leaflet for WordPress. Affected: versions up to 3.2.1 with stored cross-site scripting via the url parameter due to insufficient input sanitization and output escaping. Exploitation requires an authenticated user with Contributor-level access or higher; injected sc...

WordPress plugin Map Block Leaflet 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2025-23144 · WordPress · Map Block Leaflet

Name of the Vulnerable Software and Affected Versions: The Map Block Leaflet plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the url parameter. This allows...