WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

geo-mashup · Cross-site scripting · CWE-79

Affectedgeo-mashup

FixUpdate to 1.13.23 or newer

PublishedOct 26, 10:27 · Patchstack

ScoredOct 26 · 6.5 · Patchstack

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.

From Patchstack

Affected and fixed versions

ProductAffectedFixed ingeo-mashupearlier versions1.13.23

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-cross-site-scripting-xss-vulnerability-2?_s_id=cve · patchstack.comvdb entry

Other CVEs in geo-mashup

All 11 →

5.4WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability · CVE-2026-115954Oct 26 7.1WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability · CVE-2026-111848Oct 21 7.1WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability · CVE-2026-97250Sep 30