CVE-2026-4389

Name of the Vulnerable Software and Affected Versions DSGVO snippet for Leaflet Map and its Extensions versions prior to 3.2

Description The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is a result of inadequate input sanitization and output escaping of user-supplied attributes, specifically unset, before, and after, within the leafext-cookie-time and leafext-delete-cookie shortcodes. An authenticated attacker with contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page.

Recommendations Update DSGVO snippet for Leaflet Map and its Extensions to version 3.2 or later.