Geo Mashup EUVD-2026-109726

Exploitation requires an authenticated account with at least low-level privileges (PR:L) capable of submitting content to a Geo Mashup plugin field that is stored and rendered, plus a victim who subsequently views the affected page (UI:R) for the stored script to execute. Affected: Geo Mashup versions through 1.13.22 on WordPress. Limiting factors that reduce realistic risk: the attacker must already have a valid low-privilege account on the target site, and the payload only fires when another user loads the affected page, so there is no remote unauthenticated path and no fully automatable trigger. The specific vulnerable field/parameter is not identified in the available sources.

This is a stored cross-site scripting flaw (CWE-79) in the Geo Mashup WordPress plugin, rated 6.5 (medium). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity issue that nonetheless requires some authenticated privilege (PR:L) to plant the payload and victim interaction (UI:R) to fire it, with a scope change (S:C) reflecting execution in a separate security context (the victim's browser/WordPress session). vuln.today assigns a 'this_month' priority rather than act_now or emergency, consistent with a medium-severity, interaction-dependent plugin bug. No EPSS score, no CISA KEV listing, and no SSVC decision content were supplied, so exploitation probability and automatability cannot be quantified from this data - treat their absence as unknown, not as evidence of low risk. The only reference is a Patchstack vulnerability-database entry (the reporter), which documents the issue but is not provided as confirmed working exploit code. Net assessment: a legitimate but not urgent issue - the privilege and user-interaction requirements meaningfully limit mass exploitation, making this a routine patch-this-cycle item rather than an emergency.

A low-privileged authenticated user (e.g. a contributor or author able to create Geo Mashup content) injects a malicious script into a plugin field that is stored and later rendered without proper neutralization. When an administrator or other user views the affected page, the script executes in their browser session, potentially enabling session/credential theft or actions in their context. No verified public exploit code is provided in the input, only a vulnerability-database reference.