EUVD-2026-107279
GHSA-wcr6-r38v-74h5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a reflected cross-site scripting flaw (CWE-79) in the Geo Mashup WordPress plugin, reported by Patchstack with a CVSS 3.1 score of 7.1. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation requiring no attacker privileges but mandating victim interaction (UI:R), with a scope change (S:C) reflecting script execution in the victim's browser context rather than the server. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 7.1 'High' rating is primarily driven by the unauthenticated network vector and scope change typical of Patchstack's reflected-XSS scoring; however, the required user interaction (a victim must be lured into clicking a crafted link) and the limited C:L/I:L impact meaningfully reduce real-world risk compared to a wormable or server-side flaw. Treat this as a standard patch-on-cycle issue for sites running the affected plugin rather than an emergency, absent any EPSS/KEV signal to the contrary - the absence of those signals is not itself a data error, just an indication exploitation is not currently tracked as widespread. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Reflected cross-site scripting in the Geo Mashup WordPress plugin through version 1.13.22 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, potentially stealing session data or manipulating page content. The CVSS 3.1 score is 7.1 with a changed-scope impact, and the vector requires user interaction from the victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Patch status is not confirmed from the provided data; the affected range ends at 1.13.22, so check for a release later than 1.13.22 via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-cross-site-scripting-xss-vulnerability?_s_id=cve and the plugin vendor before upgrading. If no patched release is available, disable the Geo Mashup plugin until a fix is published, accepting the loss of its mapping and geotagging functionality. As interim controls, deploy WAF rules that detect and block script payloads targeting Geo Mashup request parameters, understanding that generic XSS signatures can produce false positives and may be bypassed; enforce a restrictive Content Security Policy to reduce execution of injected script, with the trade-off that legitimate inline scripts may break; and limit exposure of plugin-specific endpoints to trusted users where operationally feasible. Because exploitation requires a victim to follow a crafted request, user awareness measures can reduce likelihood but are not a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 covers improper neutralization of input during web page generation, and this CVE is a reflected XSS case in the Dylan Kuhn Geo Mashup WordPress plugin. In a reflected XSS pattern, the plugin accepts attacker-controlled input from an HTTP request and includes it in a generated HTML response without sufficient encoding or validation, causing the browser to execute attacker-supplied script in the context of the vulnerable WordPress site. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C indicates network reachability, low attack complexity, no authentication requirement, required victim interaction, and changed scope, meaning injected script can affect resources beyond the vulnerable component's immediate security context, such as the victim's browser session for that site. The CPE cpe:2.3:a:dylan_kuhn:geo_mashup:*:*:*:*:*:*:*:* represents the Geo Mashup plugin, and the wildcard version range corresponds to the advisory's statement that versions through 1.13.22 are affected.
Know when Geo Mashup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
Executive ViewAI
The Geo Mashup WordPress plugin, versions through 1.13.22, has a high-severity security flaw with no vendor-released patch identified at time of analysis; sites running it may expose administrators and visitors who follow crafted links to session-data theft or page-content manipulation. Leadership should care because public-facing WordPress properties could face account-integrity and trust damage, though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; deactivate or remove Geo Mashup through 1.13.22 where possible, restrict administrative and plugin access to trusted users, deploy WAF/virtual patching rules for reflected XSS, enforce MFA and least privilege, and monitor for suspicious requests or content changes until a fixed version is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Geo Mashup
View allThe Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. Rat
Time-based SQL injection in WordPress Geo Mashup plugin ≤1.13.18 allows unauthenticated remote attackers to extract sens
SQL injection in the Geo Mashup WordPress plugin (versions <= 1.13.19) allows authenticated users with Subscriber-level
Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote,
Time-based blind SQL injection in Geo Mashup WordPress plugin allows unauthenticated remote attackers to extract databas
Time-based SQL injection in Geo Mashup WordPress plugin versions ≤1.13.18 allows unauthenticated remote attackers to ext
Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mas
Stored cross-site scripting in the Geo Mashup plugin for WordPress (versions through 1.13.21) lets a holder of a Contrib
Stored XSS in the Geo Mashup WordPress plugin (versions through 1.13.18) allows authenticated low-privileged users to pe
Time-based blind SQL injection in Geo Mashup WordPress plugin versions up to 1.13.19 allows authenticated attackers with
Exploit-DB