This vulnerability in bozdoz Leaflet Map (<= 3.4.4) involves improper input neutralization during web page generation, leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that are stored and later executed in the context of users viewing the affected web pages. The issue is documented as CVE-2026-39646 with no CVSS score or remediation information currently available.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions depending on the application's context. However, no known exploits have been reported, and the exact impact depends on the deployment and usage of the affected product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding as a temporary mitigation to prevent injection of malicious scripts. Monitor vendor channels for updates regarding patches or official mitigations.