Geo Mashup vulnerabilities

The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.

CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.

Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.

Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.

The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.