Geo Mashup CVE-2026-78294

Requires a working Contributor-level (or higher) authenticated account on the target WordPress site, so it is exploitable only where untrusted users can obtain such accounts (multi-author blogs, membership/community sites). Exploitation further depends on the Geo Mashup plugin (<=1.13.21) being installed and active, and on a second victim user with a more privileged session viewing the attacker's injected content (UI:R). It does NOT work against default single-admin installations with no untrusted contributors, and cannot be triggered by fully unauthenticated remote attackers.

This is a moderate-severity, authenticated stored/injected XSS in the Geo Mashup WordPress plugin (<=1.13.21), reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) tells a consistent story: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and victim interaction (UI:R). The PR:L combined with the 'Contributor' qualifier in the title means an attacker must already hold a Contributor-level account, which sharply narrows the real-world attacker population versus an unauthenticated flaw. The scope change (S:C) reflects script executing in another user's browser context (e.g. an admin previewing content), yielding the low-but-broad C:L/I:L/A:L impacts typical of XSS. On exploitation signals: no EPSS score, no CISA KEV listing, and no public POC were provided - so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description; both indicate authenticated, interaction-dependent web exploitation. Net: this is a real but lower-priority issue - a self-service (Contributor) foothold plus an admin viewing the malicious content is required, making it more relevant to multi-author sites than a mass-exploitable perimeter bug.

An attacker who has registered or been granted a Contributor account on a multi-author WordPress site submits content or geo/map field input containing a malicious script payload through Geo Mashup. When a higher-privileged user (e.g. an editor or administrator) previews or views that content in wp-admin, the script executes in their authenticated session, potentially performing actions as that user. No public POC or active exploitation was reported at time of analysis.