CVE-2026-97250
HighCVSS 7.1Summary
The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Risk Assessment
An unauthenticated attacker can inject malicious script that executes in a user's browser, potentially leading to session or data theft.
Recommendation
Update the Geo Mashup plugin to a version later than 1.13.21 or apply available mitigations.
Other vulnerabilities in Geo Mashup
See all- CVE-2026-48967High
There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.
- CVE-2026-42734High
CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.
- CVE-2026-78294Medium
Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.
- CVE-2026-66450High
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-66449High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-27427Medium
The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS