[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWPL7DIn98B28F-TsnRm6q2ZB_PqKaf8EZNuXb1jdOPs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-57380","extensions-for-leaflet-map-unauthenticated-stored-cross-site-scripting","Extensions for Leaflet Map \u003C= 5.1 - Unauthenticated Stored Cross-Site Scripting","The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","extensions-leaflet-map",null,"\u003C=5.1","5.2","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 00:00:00","2026-07-14 19:48:52",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F92d94f9a-150f-40ca-88e1-57cbd6e6880a?source=api-prod",8,[22,23,24,25,26,27,28],"admin\u002Ffilemgr\u002Ffilemgr-settings.php","admin\u002Ffilemgr\u002Ffilemgr.php","admin\u002Ffilemgr\u002Fmain.php","admin\u002Ffilemgr\u002Fmanagefiles-functions.php","admin\u002Ffilemgr\u002Fthickbox.php","admin\u002Fhelp.php","admin\u002Fmarker\u002Fextramarker.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57380\n\n## 1. Vulnerability Summary\nThe **Extensions for Leaflet Map** plugin for WordPress (versions \u003C= 5.1) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin's file management system—specifically the uploader and subsequent file listing—fails to sanitize filenames. An attacker can upload a file with a malicious name containing a shortcode breakout and a script tag. When an administrative user views the file listing or a file preview (Thickbox), the malicious filename is processed by `do_shortcode()` without proper escaping, leading to script execution in the admin context.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n- **Action:** `leafext_upload` (inferred from `admin\u002Ffilemgr\u002Fuploader.php` and `admin\u002Ffilemgr\u002Fmain.php`).\n- **Parameter:** `leafext_file` (the uploaded file) or filename-related parameters in the multipart request.\n- **Authentication:** Unauthenticated (the uploader endpoint in version 5.1 does not perform `is_user_logged_in()` or capability checks).\n- **Preconditions:** The \"uploader\" feature must be accessible (often active by default or when GPX\u002FKML uploads are enabled in `leafext_filemgr` settings).\n\n## 3. Code Flow\n1. **Entry (Upload):** An unauthenticated request is sent to `admin-ajax.php` with the action `leafext_upload`.\n2. **Storage:** The handler in `admin\u002Ffilemgr\u002Fuploader.php` (referenced in `main.php`) saves the file to `\u002Fwp-content\u002Fuploads\u002Fleafext\u002F` (or a subdirectory like `gpx\u002F` or `kml\u002F`) using its original filename without sanitization.\n3. **Retrieval:** An admin navigates to the \"List Files\" tab (`?page=leafext_filemgr&tab=filemgr-list`). This triggers `leafext_managefiles()` which calls `leafext_list_paginate()` in `admin\u002Ffilemgr\u002Fmanagefiles-functions.php`.\n4. **Processing:**","The Extensions for Leaflet Map plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 5.1. This occurs because the plugin's file uploader accepts unsanitized filenames which are subsequently embedded into a shortcode and processed by the do_shortcode function without proper output escaping, allowing script execution in the administrative context.","\u002F\u002F admin\u002Ffilemgr\u002Fthickbox.php line 42\necho do_shortcode( '[leaflet-map  height=300 width=300 !scrollwheel !dragging fitbounds][leaflet-' . $type . ' src=\"' . $upload_url . $track . '\"]{name}[\u002Fleaflet-' . $type . ']' );\n\n--- \n\n\u002F\u002F admin\u002Ffilemgr\u002Fmanagefiles-functions.php line 220\n$entry['post_title'] = $myfile;\nif ( $type !== '' ) {\n    $entry['view'] = '\u003Ca href=\"' . esc_url( get_admin_url( null, 'admin.php?page=' . $page ) ) . '&tab=' . $tab . '&track='\n    . $myfile . '&TB_iframe=true\" class=\"thickbox\">' . __( 'Preview', 'extensions-leaflet-map' ) . '\u003C\u002Fa>';\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.1\u002Fadmin\u002Ffilemgr\u002Ffilemgr.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.2\u002Fadmin\u002Ffilemgr\u002Ffilemgr.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.1\u002Fadmin\u002Ffilemgr\u002Ffilemgr.php\t2026-04-04 20:22:12.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.2\u002Fadmin\u002Ffilemgr\u002Ffilemgr.php\t2026-06-08 19:45:20.000000000 +0000\n@@ -182,7 +182,6 @@\n \t$track = isset( $get['track'] ) ? filter_input( INPUT_GET, 'track', FILTER_SANITIZE_SPECIAL_CHARS ) : '';\n \n \tif ( $track !== '' ) {\n-\t\tinclude __DIR__ . '\u002Fthickbox.php';\n \t\tleafext_thickbox( $track );\n \t} else {\n \t\t\u002F\u002F echo '\u003Cpre>';\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.1\u002Fadmin\u002Ffilemgr\u002Fthickbox.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.2\u002Fadmin\u002Ffilemgr\u002Fthickbox.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.1\u002Fadmin\u002Ffilemgr\u002Fthickbox.php\t2026-05-04 15:06:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fextensions-leaflet-map\u002F5.2\u002Fadmin\u002Ffilemgr\u002Fthickbox.php\t2026-06-08 19:45:20.000000000 +0000\n@@ -8,13 +8,14 @@\n \u002F\u002F Direktzugriff auf diese Datei verhindern.\n defined( 'ABSPATH' ) || die();\n \n-function leafext_thickbox( $track ) {\n-\techo '\u003Cstyle>#wpadminbar { display:none;}\n-  html.wp-toolbar {padding-top: 0;}\n-  .nav-tab-wrapper {display: none;}\n-  .nothickbox {display: none;}\n-  \u003C\u002Fstyle>';\n-\t\u002F\u002F date_default_timezone_set(wp_timezone_string());\n+function leafext_thickbox_action_page() {\n+\t$track = filter_input(\n+\t\tINPUT_GET,\n+\t\t'track',\n+\t\tFILTER_CALLBACK,\n+\t\tarray( 'options' => 'esc_html' )\n+\t);\n+\n \t$upload_dir  = wp_get_upload_dir();\n \t$upload_path = $upload_dir['basedir'];\n \t$upload_url  = $upload_dir['baseurl'];\n@@ -42,7 +43,7 @@\n \tesc_html_e( 'File size: ', 'extensions-leaflet-map' );\n \techo '\u003C\u002Fstrong> ' . esc_html( size_format( filesize( $upload_path . $track ) ) ) . '\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cp>';\n \techo do_shortcode( '[leaflet-map  height=300 width=300 !scrollwheel !dragging fitbounds][leaflet-' . $type . ' src=\"' . $upload_url . $track . '\"]{name}[\u002Fleaflet-' . $type . ']' );\n-\techo '\u003C\u002Fp>\u003C\u002Fdiv>';\n+\techo '\u003C\u002Fp>';\n \n \t$data = '';\n \tif ( 'gpx' === $type ) {\n@@ -58,6 +59,9 @@\n \t\t\t\t'value' => $value,\n \t\t\t);\n \t\t}\n-\t\techo wp_kses_post( leafext_html_table( $form_fields ) );\n+\t\techo wp_kses_post( leafext_html_table( $form_fields ) ) . '\u003C\u002Fdiv>';\n \t}\n+\tiframe_footer();\n+\texit;\n }\n+add_action( 'admin_action_filemgr-list', 'leafext_thickbox_action_page' );","1. An unauthenticated attacker sends a multipart form request to \u002Fwp-admin\u002Fadmin-ajax.php with the action 'leafext_upload'.\n2. The attacker uploads a file (e.g., .gpx or .kml) where the filename contains an XSS payload designed to break out of a shortcode attribute, such as \">\u003Cscript>alert(document.cookie)\u003C\u002Fscript>.gpx.\n3. The plugin saves the file using its original filename in the \u002Fwp-content\u002Fuploads\u002Fleafext\u002F directory without sanitization.\n4. An administrator navigates to the 'List Files' tab of the plugin settings (wp-admin\u002Fadmin.php?page=leafext_filemgr&tab=filemgr-list).\n5. The administrator clicks 'Preview' for the malicious file, triggering the leafext_thickbox function.\n6. The plugin constructs a shortcode string using the unsanitized filename and passes it to do_shortcode(), which processes the string and renders the malicious script into the administrative page context.","gemini-3-flash-preview","2026-07-25 08:58:21","2026-07-25 08:59:50",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fextensions-leaflet-map\u002Ftags\u002F5.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fextensions-leaflet-map.5.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fextensions-leaflet-map\u002Ftags\u002F5.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fextensions-leaflet-map.5.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fextensions-leaflet-map\u002Ftags"]