WordPress plugin
GEO my WP security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High6
- Medium7
- Low0
All GEO my WP vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤4.5.5.5Update to 4.5.5.7 | CVE-2026-114193 | |
| High8.1 | Unauthenticated PHP Object Injection ≤4.5.5.3Update to 4.5.5.4 | CVE-2026-61992 | |
| High7.5 | Unauthenticated Local File Inclusion ≤4.5.5.3Update to 4.5.5.4 | CVE-2026-85200 | |
| Medium4.3 | Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion ≤4.5.5.2Update to 4.5.5.3 | CVE-2026-15260 | |
| High7.5 | Unauthenticated SQL Injection ≤4.5.5Update to 4.5.5.1 | CVE-2026-52715 | |
| High7.5 | Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters ≤4.5.5Update to 4.5.5.1 | CVE-2026-9757 | |
| High7.5 | Unauthenticated SQL Injection ≤4.5.4Update to 4.5.5 | — | |
| Critical9.1 | Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters ≤4.5.4Update to 4.5.5 | CVE-2026-15300 | |
| Medium5.4 | Missing Authorization via get_field_options_ajax ≤4.5.0.4Update to 4.5.1 | CVE-2024-54326 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload 4.0 – 4.4.0.2Update to 4.5 | CVE-2024-9422 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.5.0.3Update to 4.5.0.4 | CVE-2024-47327 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤4.5.0.1Update to 4.5.0.2 | CVE-2024-6330 | |
| Medium4.3 | Cross-Site Request Forgery ≤4.1Update to 4.2 | CVE-2024-32097 | |
| Medium6.6 | Authenticated(Administrator+) SQL Injection <4.0.3Update to 4.0.3 | CVE-2023-52134 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤4.0Update to 4.0.1 | CVE-2023-5467 |
- Medium5.3Missing Authorization
≤4.5.5.5Update to 4.5.5.7
- High8.1Unauthenticated PHP Object Injection
≤4.5.5.3Update to 4.5.5.4
- High7.5Unauthenticated Local File Inclusion
≤4.5.5.3Update to 4.5.5.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion
≤4.5.5.2Update to 4.5.5.3
- High7.5Unauthenticated SQL Injection
≤4.5.5Update to 4.5.5.1
- High7.5Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
≤4.5.5Update to 4.5.5.1
- High7.5Unauthenticated SQL Injection
≤4.5.4Update to 4.5.5
- Critical9.1Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
≤4.5.4Update to 4.5.5
- Medium5.4Missing Authorization via get_field_options_ajax
≤4.5.0.4Update to 4.5.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
4.0 – 4.4.0.2Update to 4.5
- Medium6.1Reflected Cross-Site Scripting
≤4.5.0.3Update to 4.5.0.4
- Critical9.8Unauthenticated Local File Inclusion
≤4.5.0.1Update to 4.5.0.2
- Medium4.3Cross-Site Request Forgery
≤4.1Update to 4.2
- Medium6.6Authenticated(Administrator+) SQL Injection
<4.0.3Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.0Update to 4.0.1
GEO my WP: common questions
Does GEO my WP have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in GEO my WP: 2 critical, 6 high, 7 medium. None are known to affect version null.
How do I check which version of GEO my WP I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent GEO my WP vulnerability?
CVE-2026-114193, published Oct 27, 2026: GEO my WP <= 4.5.5.5 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any GEO my WP vulnerability listed in CISA KEV?
No. None of the known GEO my WP vulnerabilities is currently listed in the CISA KEV catalog.