What is the CVSS score of EUVD-2026-57871?

EUVD-2026-57871 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Geo Mashup are affected by EUVD-2026-57871?

The Geo Mashup WordPress plugin (versions 1.13.18 and earlier) contains an unauthenticated cross-site scripting vulnerability allowing remote attackers to inject malicious JavaScript into pages…

How to fix or mitigate EUVD-2026-57871?

Within 24 hours, immediately disable or deactivate the Geo Mashup plugin on all WordPress installations running version 1.13.18 or earlier to prevent exploitation; audit and document all affected instances and alert engineering and security teams. Within 7 days, review server logs and access patterns from the plugin's deployment window to identify any indicators of compromise; implement Web Application Firewall rules to block XSS payloads as interim protection if plugin removal is not immediately operationally feasible. Within 30 days, establish vendor contact to track patch availability; evaluate and test alternative geolocation plugins; once the vendor releases versions exceeding 1.13.18, perform staging validation before deploying to all production WordPress instances.

Geo Mashup EUVD-2026-57871

| CVE-2026-66449 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-vcj7-r74g-x87v

WordPress XSS Geo Mashup Wordpress Plugin Dylan Kuhn

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with no auth and required user interaction; A:N assigned because XSS does not produce measurable availability impact on the server or victim system.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:36 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Geo Mashup (CPE: cpe:2.3:a:dylan_kuhn:geo_mashup) is a WordPress plugin authored by Dylan Kuhn that embeds geographic mapping and location data directly into WordPress posts and pages. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input - likely location labels, map query parameters, or shortcode arguments handled by the plugin - is reflected or rendered into HTML output without adequate escaping or sanitization. The CVSS scope-changed metric (S:C) confirms the injected script executes in the victim's browser security context, separate from the WordPress server process, enabling cross-origin actions such as cookie exfiltration or forced authenticated requests against the WordPress admin interface.

RemediationAI

Update the Geo Mashup WordPress plugin to the latest available version beyond 1.13.18 as documented in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-18-cross-site-scripting-xss-vulnerability-2). A specific patched release version was not independently confirmed from the provided input data - verify the current release via the WordPress plugin repository or the plugin's GitHub repository before deploying. If an immediate update is not feasible, consider deploying a WAF rule targeting reflected script injection patterns in Geo Mashup plugin parameters as a temporary compensating control, noting that WAF coverage for XSS is often incomplete and bypassed, making it an unreliable long-term substitute for patching.