Extensions for Leaflet Map <= 5.1 - Unauthenticated Stored Cross-Site Scripting
Description
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=5.1What Changed in the Fix
Changes introduced in v5.2
Source Code
WordPress.org SVN# Exploitation Research Plan: CVE-2026-57380 ## 1. Vulnerability Summary The **Extensions for Leaflet Map** plugin for WordPress (versions <= 5.1) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin's file management system—specificall…
Show full research plan
Exploitation Research Plan: CVE-2026-57380
1. Vulnerability Summary
The Extensions for Leaflet Map plugin for WordPress (versions <= 5.1) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin's file management system—specifically the uploader and subsequent file listing—fails to sanitize filenames. An attacker can upload a file with a malicious name containing a shortcode breakout and a script tag. When an administrative user views the file listing or a file preview (Thickbox), the malicious filename is processed by do_shortcode() without proper escaping, leading to script execution in the admin context.
2. Attack Vector Analysis
- Endpoint:
wp-admin/admin-ajax.php - Action:
leafext_upload(inferred fromadmin/filemgr/uploader.phpandadmin/filemgr/main.php). - Parameter:
leafext_file(the uploaded file) or filename-related parameters in the multipart request. - Authentication: Unauthenticated (the uploader endpoint in version 5.1 does not perform
is_user_logged_in()or capability checks). - Preconditions: The "uploader" feature must be accessible (often active by default or when GPX/KML uploads are enabled in
leafext_filemgrsettings).
3. Code Flow
- Entry (Upload): An unauthenticated request is sent to
admin-ajax.phpwith the actionleafext_upload. - Storage: The handler in
admin/filemgr/uploader.php(referenced inmain.php) saves the file to/wp-content/uploads/leafext/(or a subdirectory likegpx/orkml/) using its original filename without sanitization. - Retrieval: An admin navigates to the "List Files" tab (
?page=leafext_filemgr&tab=filemgr-list). This triggersleafext_managefiles()which callsleafext_list_paginate()inadmin/filemgr/managefiles-functions.php. - Processing:
Summary
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 5.1. This occurs because the plugin's file uploader accepts unsanitized filenames which are subsequently embedded into a shortcode and processed by the do_shortcode function without proper output escaping, allowing script execution in the administrative context.
Vulnerable Code
// admin/filemgr/thickbox.php line 42 echo do_shortcode( '[leaflet-map height=300 width=300 !scrollwheel !dragging fitbounds][leaflet-' . $type . ' src="' . $upload_url . $track . '"]{name}[/leaflet-' . $type . ']' ); --- // admin/filemgr/managefiles-functions.php line 220 $entry['post_title'] = $myfile; if ( $type !== '' ) { $entry['view'] = '<a href="' . esc_url( get_admin_url( null, 'admin.php?page=' . $page ) ) . '&tab=' . $tab . '&track=' . $myfile . '&TB_iframe=true" class="thickbox">' . __( 'Preview', 'extensions-leaflet-map' ) . '</a>'; }
Security Fix
@@ -182,7 +182,6 @@ $track = isset( $get['track'] ) ? filter_input( INPUT_GET, 'track', FILTER_SANITIZE_SPECIAL_CHARS ) : ''; if ( $track !== '' ) { - include __DIR__ . '/thickbox.php'; leafext_thickbox( $track ); } else { // echo '<pre>'; @@ -8,13 +8,14 @@ // Direktzugriff auf diese Datei verhindern. defined( 'ABSPATH' ) || die(); -function leafext_thickbox( $track ) { - echo '<style>#wpadminbar { display:none;} - html.wp-toolbar {padding-top: 0;} - .nav-tab-wrapper {display: none;} - .nothickbox {display: none;} - </style>'; - // date_default_timezone_set(wp_timezone_string()); +function leafext_thickbox_action_page() { + $track = filter_input( + INPUT_GET, + 'track', + FILTER_CALLBACK, + array( 'options' => 'esc_html' ) + ); + $upload_dir = wp_get_upload_dir(); $upload_path = $upload_dir['basedir']; $upload_url = $upload_dir['baseurl']; @@ -42,7 +43,7 @@ esc_html_e( 'File size: ', 'extensions-leaflet-map' ); echo '</strong> ' . esc_html( size_format( filesize( $upload_path . $track ) ) ) . '</div></div><p>'; echo do_shortcode( '[leaflet-map height=300 width=300 !scrollwheel !dragging fitbounds][leaflet-' . $type . ' src="' . $upload_url . $track . '"]{name}[/leaflet-' . $type . ']' ); - echo '</p></div>'; + echo '</p>'; $data = ''; if ( 'gpx' === $type ) { @@ -58,6 +59,9 @@ 'value' => $value, ); } - echo wp_kses_post( leafext_html_table( $form_fields ) ); + echo wp_kses_post( leafext_html_table( $form_fields ) ) . '</div>'; } + iframe_footer(); + exit; } +add_action( 'admin_action_filemgr-list', 'leafext_thickbox_action_page' );
Exploit Outline
1. An unauthenticated attacker sends a multipart form request to /wp-admin/admin-ajax.php with the action 'leafext_upload'. 2. The attacker uploads a file (e.g., .gpx or .kml) where the filename contains an XSS payload designed to break out of a shortcode attribute, such as "><script>alert(document.cookie)</script>.gpx. 3. The plugin saves the file using its original filename in the /wp-content/uploads/leafext/ directory without sanitization. 4. An administrator navigates to the 'List Files' tab of the plugin settings (wp-admin/admin.php?page=leafext_filemgr&tab=filemgr-list). 5. The administrator clicks 'Preview' for the malicious file, triggering the leafext_thickbox function. 6. The plugin constructs a shortcode string using the unsanitized filename and passes it to do_shortcode(), which processes the string and renders the malicious script into the administrative page context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.