What is the CVSS score of CVE-2026-42734?

CVE-2026-42734 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-42734?

The Geo Mashup WordPress plugin (all versions through 1.13.19) contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to craft deceptive links that execute…

How to fix or mitigate CVE-2026-42734?

24 hours: Inventory all WordPress installations using Geo Mashup plugin and identify current versions; disable or remove the plugin from production if not critical to operations. 7 days: If plugin must remain active, implement Web Application Firewall rules blocking XSS payloads and deploy Content Security Policy headers (script-src 'self'); review access logs for exploitation attempts. 30 days: Evaluate replacement geolocation/mapping plugins without known vulnerabilities; if alternative found, develop and execute migration plan; if no replacement exists, formally document the plugin's deprecation timeline and establish ongoing monitoring and WAF rules.

Wordpress Plugin CVE-2026-42734

EUVD-2026-32179 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 audit@patchstack.com

GHSA-jh8h-gfc6-89v8

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:50 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through <= 1.13.19.

AnalysisAI

Reflected cross-site scripting in the Geo Mashup WordPress plugin (Dylan Kuhn) affects all versions up to and including 1.13.19, letting an unauthenticated attacker inject script that executes in a victim's browser when they click a crafted link. The CVSS 3.1 base score is 7.1 with a changed scope, reflecting that injected script can affect resources beyond the vulnerable component, though confidentiality, integrity, and availability impacts are each rated low. EPSS is very low (0.03%, 10th percentile) and there is no public exploit identified at time of analysis.