Is CVE-2026-57380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57380 being exploited in the wild.

How severe is CVE-2026-57380?

High severity, with a CVSS score of 7.1, published 13 July 2026.

Which products and versions are affected?

Hupe13 Extensions for Leaflet Map <= 5.1.

Is there a fix for CVE-2026-57380?

A patch was published on 2026-07-13: Patch available in version 5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57380 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57380?

Check whether you run Hupe13 Extensions for Leaflet Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57380: hupe13 Extensions for Leaflet Map DOM-based XSS

Q: Is there a fix for CVE-2026-57380?

A patch was published on 2026-07-13: Patch available in version 5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57380 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57380?

Check whether you run Hupe13 Extensions for Leaflet Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57380 · Severity: high · CVSS 7.1 · Published 2026-07-13

The Extensions for Leaflet Map plugin for WordPress is vulnerable to a security flaw that allows attackers to inject malicious scripts into web pages. This plugin is used to add interactive maps to websites. If exploited, an attacker could redirect visitors to malicious sites, steal session information, or display unauthorized content, potentially damaging the website's reputation and compromising user data.

Technologies: Hupe13 Extensions for Leaflet Map. Vendors: Hupe13.

Quick answers

Is CVE-2026-57380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57380 being exploited in the wild.
How severe is CVE-2026-57380?: High severity, with a CVSS score of 7.1, published 13 July 2026.
Which products and versions are affected?: Hupe13 Extensions for Leaflet Map <= 5.1.
Is there a fix for CVE-2026-57380?: A patch was published on 2026-07-13: Patch available in version 5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57380 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57380?: Check whether you run Hupe13 Extensions for Leaflet Map at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the hupe13 Extensions for Leaflet Map plugin for WordPress due to improper neutralization of user-supplied input during web page generation. The flaw allows unauthenticated attackers to inject malicious scripts into the Document Object Model (DOM) environment. Successful exploitation requires a victim to interact with a specially crafted link or page (User Interaction). Once executed, the script runs in the context of the victim's browser session, potentially allowing for session hijacking or unauthorized actions. The issue is resolved in version 5.2.

Affected products

hupe13 Extensions for Leaflet Map <= 5.1

Timeline

2026-06-03: other: Vulnerability reported by researcher manop55555
2026-07-07: disclosed: Initial disclosure by Patchstack
2026-07-13: advisory: NVD publication date
2026-07-13: patched: Patch available in version 5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.