CVE-2012-2913: Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote...

Security readout for executives and security teams

This is an old cross-site scripting issue in the Leaflet WordPress plugin 0.0.1. The cited CVE says attackers could inject script or HTML through an id parameter in plugin admin-related PHP pages. Business impact depends on whether any WordPress site still runs this exact plugin version. Exposure is likely limited to WordPress installations using Leaflet plugin version 0.0.1. The public record does not provide CPEs or a broader affected-version range. Environments without this plugin, or not using the vulnerable version, are not indicated as affected by the supplied sources. Treat this as a targeted legacy WordPress exposure check, not a broad emergency. Prioritize confirming whether the obsolete plugin version exists. If present on internet-facing or business-critical sites, remove or replace it quickly because XSS in WordPress admin contexts can threaten user sessions and site integrity. Mitigation focus: Inventory WordPress sites for Leaflet plugin 0.0.1.; Check plugin or vendor guidance for a fixed release or supported replacement.; Remove the plugin if it is unused or unsupported..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.