PT-2026-28206 · WordPress · Dsgvo Snippet For Leaflet Map/Its Extensions

Djaidja Moundjid · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4389

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DSGVO snippet for Leaflet Map and its Extensions versions prior to 3.2

Description The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is a result of inadequate input sanitization and output escaping of user-supplied attributes, specifically unset, before, and after, within the leafext-cookie-time and leafext-delete-cookie shortcodes. An authenticated attacker with contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page.

Recommendations Update DSGVO snippet for Leaflet Map and its Extensions to version 3.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4389

Affected Products

Dsgvo Snippet For Leaflet Map/Its Extensions

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4389 · Security Note
• https://plugins.trac.wordpress.org/browser/dsgvo-leaflet-map/tags/3.4 · Note
• https://plugins.trac.wordpress.org/browser/dsgvo-leaflet-map/trunk/php/time-delete.php#L35 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489426%40dsgvo-leaflet-map%2Ftrunk&old=3488424%40dsgvo-leaflet-map%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/dsgvo-leaflet-map/tags/3.1/php/time-delete.php#L35 · Note
• https://twitter.com/CVEnew/status/2037137739804463541 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/dfeaff92-165a-4006-8e52-a99ae6b68dd9?source=cve · Note