Vulnerabilities

TI-2026-28617 CVE-2026-39646 · GHSA-jggj-35mq-63v8

WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00167 Published 2026-04-08 No fix listed CWE-79

TI-2025-23559 CVE-2025-32494 · GHSA-hfpr-xhrf-jgv3

WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Jetpack: from n/a through <= 0.2.2.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00213 Published 2025-04-09 No fix listed CWE-352

TI-2025-16475 CVE-2025-22589 · GHSA-mhp7-xr6g-mvhv

WordPress Quote Tweet plugin <= 0.7 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00156 Published 2025-01-07 No fix listed CWE-352

TI-2024-03679 CVE-2024-3941 · GHSA-8c9g-w38h-qxj2

reCAPTCHA Jetpack <= 0.2.2 - Stored XSS via CSRF

LOW 21

The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads v…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00269 Published 2024-05-10 No fix listed CWE-352

TI-2024-03678 CVE-2024-3940 · GHSA-3g3h-99q7-v8x2

reCAPTCHA Jetpack <= 0.2.2 - Settings Update via CSRF

HIGH 71

The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00381 Published 2024-05-10 No fix listed CWE-352

TI-2023-04650 CVE-2023-5050 · GHSA-cx68-9cx9-qmrj

Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 29

The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00492 Published 2023-10-20 No fix listed CWE-79

TI-2021-06757 CVE-2021-24468 · GHSA-9px2-pxx2-vq3x

Leaflet Map < 3.0.0 - Contributor+ Stored XSS

LOW 25

The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS is…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-08-02 Fixed in 3.0.0 CWE-79