CVE-2026-39646

CVE-2026-39646 is a Stored Cross-Site Scripting (XSS) vulnerability in bozdoz Leaflet Map, a popular WordPress mapping plugin, affecting versions 3.4.4 and earlier. The vulnerability stems from improper neutralization of user input during web page generation, allowing attackers to inject and persist malicious scripts. This is a stored XSS variant, meaning the malicious payload remains in the system and executes for all users who view the affected content. The vulnerability has a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and user interaction to exploit. An authenticated attacker can leverage this flaw to compromise confidentiality, integrity, and availability across the compromised scope, though impact is limited to low levels. The attack requires prior login privileges (PR:L) and user interaction (UI:R), which moderately constrains the threat landscape. Exploitation status appears minimal at present. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and is inactive on security hot lists, indicating no current mass exploitation campaigns. With an EPSS score of 0.00034, the probability of exploitation in the wild is extremely low relative to other disclosed vulnerabilities. However, organizations using affected Leaflet Map versions should prioritize updating to version 3.4.5 or later to mitigate risk before potential exploit code becomes publicly available.