CVE-2026-27427
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session theft or data compromise.
Recommendation
Update the Geo Mashup plugin to version 1.13.19 or later if available. In the meantime, apply WAF rules to block suspicious input.
Other vulnerabilities in Geo Mashup
See all- CVE-2026-48967High
There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.
- CVE-2026-42734High
CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.
- CVE-2026-66450High
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-66449High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affects Geo Mashup: from n/a through 1.13.18.