CVE-2026-111848: WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Geo Mashup pluginto a version that resolves this vulnerability.Fixed in 1.13.23
Event History
Frequently Asked Questions
Which Geo Mashup versions are affected?
Geo Mashup versions through 1.13.22 are affected. The available data does not identify a fixed version.
What level of attacker access is required?
The issue is remotely reachable and requires no privileges, but exploitation requires user interaction. It is a reflected XSS vulnerability.
What could a successful exploit allow?
The reported impact includes low-level effects on confidentiality, integrity, and availability, with scope changed. The provided data does not specify the exact actions an attacker could perform.