WordPress Extensions for Leaflet Map plugin <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'elevation-track' Shortcode vulnerability discovered by zaim in WordPress Plugin Extensions for Leaflet Map versions = 4.14...

EUVD-2026-20645

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2026-5451

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2026-5451

CVE-2026-5451 affects the WordPress plugin Extensions for Leaflet Map . The vulnerability is a stored XSS via the elevation-track shortcode in all versions up to and including 4.14, caused by insufficient input sanitization and output escaping on user-supplied attributes. An attacker with Contrib...

CVE-2026-5451 Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2026-5451

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2026-5451 Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

PT-2026-31453

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'elevation-track' shortcode in all versions up to, and including, 4.14. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-67030 vulnerabilities

Vulnerabilities for packages: confluent-kafka, druid, kafka, maven-stage0, dependency-track, gradle, gradle-stage0, akhq, maven...

GHSA-6FMV-XXPF-W3CW vulnerabilities

Vulnerabilities for packages: confluent-kafka, druid, kafka, maven-stage0, dependency-track, gradle, gradle-stage0, akhq, maven...

GHSA-6FMV-XXPF-W3CW vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, maven-ecosystems-test, gradle, gradle-stage0, logstash, maven, clojure-tools, leiningen, dependency-track, kafka-fips, akhq, confluent-kafka-jre-bcfips, druid, kafka, confluent-kafka, apache-camel-karavan-devmode, wso2is, maven-stage0...

CVE-2025-67030 vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, maven-ecosystems-test, gradle, gradle-stage0, logstash, maven, clojure-tools, leiningen, dependency-track, kafka-fips, akhq, confluent-kafka-jre-bcfips, druid, kafka, confluent-kafka, apache-camel-karavan-devmode, wso2is, maven-stage0...

CVE-2026-25401

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through = 8.0.2...

CVE-2026-32125

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anything feature are stored from user input POST and later rendered in Dygraph charts titles/labels using innerHTML or equivalent without...

EUVD-2026-15715

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through = 8.0.2...

CVE-2026-25401

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through = 8.0.2...

CVE-2026-25401 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through = 8.0.2...

CVE-2026-25401

The CVE-2026-25401 entry describes a Missing Authorization vulnerability in the WordPress WPCargo Track & Trace plugin (Arni Cinco WPCargo Track & Trace) with a Broken Access Control issue affecting versions n/a through 8.0.2. The underlying root cause is incorrectly configured access control sec...

CVE-2026-25401 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through = 8.0.2...

PT-2026-27939

Name of the Vulnerable Software and Affected Versions Arni Cinco WPCargo Track & Trace versions n/a through 8.0.2 Description An authorization issue exists in Arni Cinco WPCargo Track & Trace wpcargo due to incorrectly configured access control security levels. This allows for exploitation of the...