CVE-2026-103485

Name of the Vulnerable Software and Affected Versions Extensions for Leaflet Map versions prior to 5.5

Description Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This requires a site administrator to have configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination with a GeoJSON src URL controlled by the attacker, such as through a compromised external data host or subdomain takeover. The issue is triggered via the feature.properties[<template-token>] parameter.

Recommendations Update to a version newer than 5.4.