WordPress Plugin Vulnerability Report – Leaflet Map – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-5050

Plugin Name: Leaflet Map

Key Information:

  • Software Type: Plugin
  • Software Slug: leaflet-map
  • Software Status: Active
  • Software Author: bozdoz
  • Software Downloads: 339,670
  • Active Installs: 30,000
  • Last Updated: September 20, 2023
  • Patched Versions: <=3.3.0
  • Affected Versions: 3.3.1

Vulnerability Details:

  • Name: Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CVE: CVE-2023-5050
  • CVSS Score: 6.4 (medium)
  • Publicly Published: September 20, 2023
  • Researcher: Lana Codes
  • Description: The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping.


The Leaflet Map plugin for WordPress has a vulnerability in versions up to and including 3.3.0 that allows for Stored Cross-Site Scripting via shortcodes. This vulnerability has been patched in version <=3.3.0.

Detailed Overview:

The vulnerability was discovered by Lana Codes and publicly announced on September 20, 2023. The issue lies in the plugin's handling of shortcodes, specifically due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level or higher permissions to inject arbitrary web scripts in pages. When executed, these scripts can compromise the security of the website, affecting both users and administrators.

The risk is rated as medium with a CVSS score of 6.4. However, given that the attack requires contributor-level access, the vulnerability is less likely to be exploited compared to those that can be triggered by anonymous users.

Advice for Users:

  • Immediate Action: It is strongly recommended to update to the latest patched version (<=3.3.0) immediately.
  • Check for Signs of Vulnerability: Regularly review your website's code and logs to identify any unauthorized changes or activity.
  • Alternate Plugins: While a patch is available, users might still consider plugins that offer similar functionality as a precaution.
  • Stay Updated: Always ensure that your plugins, including Leaflet Map, are updated to the latest versions to avoid vulnerabilities.


The prompt response from the plugin developers to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version <=3.3.0 or later to secure their WordPress installations.


Detailed Report:

Keeping your WordPress website secure should be a top priority, but it’s easy to let things slip when you’re focused on running your business. Unfortunately, I recently came across a vulnerability in a popular plugin, Leaflet Map, that could put your site at risk if you don’t take action. In this post, I’ll provide all the key details you need to understand the vulnerability and how to protect your site.

Leaflet Map is installed on over 30,000 WordPress sites to add interactive maps using shortcodes. It’s authored by bozdoz and has been downloaded over 300,000 times.

Researchers recently discovered a vulnerability, CVE-2023-5050, affecting Leaflet Map versions up to and including 3.3.0. The vulnerability allows authenticated users with at least contributor access to inject malicious scripts into pages and posts due to insufficient input sanitization. If exploited, this could lead to compromise of both the site and its users. The vulnerability has been given a severity score of 6.4 out of 10 by CVSS.

While you do need contributor access to exploit it, this is still considered a medium risk that you'll want to address promptly. The developers have patched the vulnerability in version <=3.3.0, so users should update as soon as possible. Be sure to review your site's code and logs for any unauthorized changes too.

This is the third vulnerability found in Leaflet Map since July 2021, so staying current on updates for this plugin is critical. I know how hard it is to keep tabs on every plugin with everything else going on in your business. But leaving vulnerabilities open is like leaving the door unlocked - it invites trouble.

Take a few minutes today to update Leaflet Map on your site to the latest version. And going forward, try to carve out a little time each month to check that your plugins are up-to-date. I'm always happy to help if you need an extra set of hands or reminders! With a little ongoing maintenance, you can avoid critical security risks and keep your site safe.

Don't tackle WordPress security alone - the consequences of a breach are too great. At Your WP Guy, our managed WordPress maintenance services include layers of protection like auto-updates, malware scanning, firewalls and 24/7 monitoring by WordPress experts. We become your outsourced IT team.

Let's chat about migrating your site to our managed hosting so you can finally stop worrying about security issues. We'll fully audit and lock down your site as part of onboarding. Call us at 678-995-5169 to keep your business safe online.

WordPress Plugin Vulnerability Report – Leaflet Map – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-5050 FAQs

Leave a Comment