VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Geo Mashup security & vulnerabilities

geo-mashup— active installsLast vulnerability Oct 26, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
24Known vulnerabilities
  • Critical0
  • High9
  • Medium15
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152018: 1 vulnerability1182022: 1 vulnerability1222023: 1 vulnerability1232024: 2 vulnerabilities2242025: 1 vulnerability1252026: 17 vulnerabilities1726

All Geo Mashup vulnerabilities

Geo Mashup vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤1.13.22Update to 1.13.23
CVE-2026-115953
Medium4.3Missing Authorization
≤1.13.22Update to 1.13.23
CVE-2026-115954
Medium6.1Reflected Cross-Site Scripting
≤1.13.22Update to 1.13.23
CVE-2026-111848
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.13.21Update to 1.13.22
CVE-2026-97250
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.21Update to 1.13.22
CVE-2026-78294
High8.1Unauthenticated Local File Inclusion
≤1.13.18Update to 1.13.19
CVE-2026-66450
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.13.18Update to 1.13.19
CVE-2026-66449
Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.13.19Update to 1.13.20
CVE-2026-48967
Medium5.3Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
≤1.13.19Update to 1.13.20
CVE-2026-7552
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.13.19Update to 1.13.20
CVE-2026-42734
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.18Update to 1.13.19
CVE-2026-27427
Medium6.5Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
≤1.13.19Update to 1.13.20
CVE-2026-6457
High7.5Unauthenticated Time-Based SQL Injection via 'sort' Parameter
≤1.13.18Update to 1.13.19
CVE-2026-4060
High7.5Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
≤1.13.18Update to 1.13.19
CVE-2026-4061
High7.5Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
≤1.13.18Update to 1.13.19
CVE-2026-4062
Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
≤5.5.8Update to 5.5.9
CVE-2024-13362
High7.5Unauthenticated SQL Injection via 'sort' Parameter
≤1.13.17Update to 1.13.18
CVE-2026-2416
High8.1Unauthenticated Local File Inclusion
≤1.13.16Update to 1.13.17
CVE-2025-48293
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode
≤1.13.13Update to 1.13.14
CVE-2024-8990
Medium6.5Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.13.12Update to 1.13.13
CVE-2024-44008
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974
Medium6.4< 1.10.4 - Cross-Site Scripting
<1.10.4Update to 1.10.4
CVE-2018-14071
Medium6.1Cross-Site Scripting
<1.8.3Update to 1.8.3
CVE-2015-1383

Geo Mashup: common questions

Does Geo Mashup have known vulnerabilities?

Yes. VulnCrest Radar lists 24 known vulnerabilities in Geo Mashup: 9 high, 15 medium. At least one is not fixed in the latest version.

How do I check which version of Geo Mashup I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Geo Mashup vulnerability?

CVE-2026-115953, published Oct 26, 2026: Geo Mashup <= 1.13.22 - Authenticated (Author+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Geo Mashup vulnerability listed in CISA KEV?

No. None of the known Geo Mashup vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?