leaflet-cve-2025-69993

CVE-2025-69993 — XSS in Leaflet bindPopup Cross-Site Scripting vulnerability in Leaflet = 1.9.4. The bindPopup method renders user-supplied input as raw HTML without sanitization, allowing arbitrary JavaScript execution. Repository Structure ADVISORY.md — Full security advisory with vulnerability...

CVE-2026-107265

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13...

CVE-2026-107265 Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13...

CVE-2026-107265

The Drupal Leaflet module (versions 0.0.0 to 10.4.13 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the Leaflet field formatter fails to filter content titles when building a map. This allows an attacker with sufficient permissions to create or edit c...

CVE-2026-107265 Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13...

EUVD-2026-113571

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13...

CVE-2026-103485

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103485 Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-112681

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103485

The Extensions for Leaflet Map plugin for WordPress (versions &lt;= 5.4 ) is vulnerable to Unauthenticated Stored DOM-Based Cross-Site Scripting . The root cause is insufficient input sanitization and output escaping within the feature.properties[] parameter. An unauthenticated attacker can injec...

WordPress Extensions for Leaflet Map plugin <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin Extension for Leaflet Map versions = 5.4...

hupe13 Extensions for Leaflet Map Cross-site Scripting Vulnerability

Hupe13: Extensions for Leaflet Map versions 5.4 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping of the ‘feature.properties’ parameter, resulting in stored, DOM-based cross-site scripting. Unauthenticated attackers...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-112398 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-112398 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-96637 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-96637 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-96636 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-96636 Source advisory:...

CVE-2026-114703

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0...

CVE-2026-114703 WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0...

EUVD-2026-108084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0...

CVE-2026-114703

The WordPress Extensions for Leaflet Map plugin (versions ≤ 6.0 ) is vulnerable to a Stored Cross-site Scripting (XSS) flaw. This issue, identified as CWE-79 , stems from the Improper Neutralization of Input During Web Page Generation within the extensions-leaflet-map component. An attacker could...

CVE-2026-114703 WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0...