CVE-2026-115953
MediumCVSS 6.5Summary
The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
Risk Assessment
A malicious script stored on the site could execute in users' browsers, enabling session theft or administrator account takeover.
Recommendation
Update the Geo Mashup plugin to a version later than 1.13.22.
Other vulnerabilities in Geo Mashup
See all- CVE-2026-115954Medium
The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-97250High
The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-78294Medium
Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.
- CVE-2026-66450High
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-66449High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-48967High
There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.
- CVE-2026-42734High
CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.
- CVE-2026-27427Medium
The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS