Geo Mashup CVE-2026-97250

Exploitation requires a WordPress site running the Geo Mashup plugin at version 1.13.21 or earlier and depends on victim user interaction (UI:R) - the attacker must induce a user to click a crafted link or load malicious input, so it is not fully autonomous. No authentication is required (PR:N), and the vector is network-reachable against default installations, but the scope-changing XSS only yields impact when the injected script runs in the victim's browser. The exact vulnerable parameter and endpoint are not specified in the available data, limiting precise targeting without consulting the Patchstack advisory. The primary limiting factor is the required social-engineering step plus the plugin's relatively niche deployment footprint.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated flaw whose severity is elevated primarily by the scope change (S:C) and the trio of Low impacts - typical scoring for a WordPress XSS that executes in a different security context than the vulnerable component. Critically, UI:R means exploitation is NOT automatic: a victim must be induced to click a crafted link or load attacker-controlled input, which sharply reduces real-world spray-and-pray risk compared to a click-free flaw. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so there is no evidence of active exploitation or mass weaponization; this reads as a patched, disclosure-driven Patchstack finding rather than an urgent in-the-wild threat. The description labels it 'Unauthenticated Cross Site Scripting' but does not specify reflected vs. stored, the injected parameter, or the vulnerable sink - the UI:R requirement strongly implies a reflected/social-engineering vector, but this should be verified against the Patchstack advisory. Net: a genuine but moderate-priority issue - real enough to patch promptly, but not a drop-everything emergency absent exploitation signals.

An attacker crafts a URL or input targeting a vulnerable Geo Mashup endpoint on a WordPress site running <= 1.13.21 and lures a user (potentially an administrator) into loading it. When the page renders the unsanitized input, attacker-controlled JavaScript executes in the victim's browser session in the site's context, enabling session/cookie theft, admin-action forgery, or content injection. No authentication is required to deliver the payload, but user interaction (UI:R) is needed; no public exploit code was identified at time of analysis.