WordPress plugin
Geo Controller – Geolocation & Geotargeting security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium6
- Low0
All Geo Controller – Geolocation & Geotargeting vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Unauthenticated PHP Object Injection ≤8.9.8Update to 8.9.9 | CVE-2026-78286 | |
| Medium5.3 | Unauthenticated Information Exposure ≤8.9.5Update to 8.9.6 | CVE-2025-62109 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion ≤8.7.3Update to 8.7.4 | CVE-2024-7380 | |
| Medium5.3 | Missing Authorization to Unauthenticated Shortcode Execution ≤8.6.9Update to 8.7.0 | CVE-2024-7381 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤8.6.4Update to 8.6.5 | CVE-2024-30451 | |
| High8.8 | Unauthenticated PHP Object Injection via shortcode REST API Route ≤8.6.4Update to 8.6.5 | CVE-2024-3591 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤8.5.2Update to 8.5.3 | CVE-2023-51513 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤7.13.11Update to 7.13.12 | — |
- High8.1Unauthenticated PHP Object Injection
≤8.9.8Update to 8.9.9
- Medium5.3Unauthenticated Information Exposure
≤8.9.5Update to 8.9.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
≤8.7.3Update to 8.7.4
- Medium5.3Missing Authorization to Unauthenticated Shortcode Execution
≤8.6.9Update to 8.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.6.4Update to 8.6.5
- High8.8Unauthenticated PHP Object Injection via shortcode REST API Route
≤8.6.4Update to 8.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.5.2Update to 8.5.3
- Medium6.1Reflected Cross-Site Scripting
≤7.13.11Update to 7.13.12
Geo Controller – Geolocation & Geotargeting: common questions
Does Geo Controller – Geolocation & Geotargeting have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in Geo Controller – Geolocation & Geotargeting: 2 high, 6 medium. None are known to affect version null.
How do I check which version of Geo Controller – Geolocation & Geotargeting I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Geo Controller – Geolocation & Geotargeting vulnerability?
CVE-2026-78286, published Aug 25, 2026: Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection. Severity: High (CVSS 8.1).
Is any Geo Controller – Geolocation & Geotargeting vulnerability listed in CISA KEV?
No. None of the known Geo Controller – Geolocation & Geotargeting vulnerabilities is currently listed in the CISA KEV catalog.