An extended public key is a public key that can be used to generate child public keys. It is used by wallets to derive the addresses that the wallet contains. Anyone who knows your xPub has the ability to derive all addresses associated with it, and as a result, all transactions you have made within that wallet. An xPub can not be used to generate private keys, this means that in the event that your xPub is leaked, your funds will remain safe, however your privacy will not.