WordPress plugin
GEO Plugin by Squirrly SEO security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High7
- Medium13
- Low0
All GEO Plugin by Squirrly SEO vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤14.2.5Update to 14.2.6 | CVE-2026-94076 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤14.2.2Update to 14.2.3 | CVE-2026-66614 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤14.2.0Update to 14.2.1 | CVE-2026-66664 | |
| High7.2 | Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost() ≤14.0.0Update to 14.0.1 | CVE-2026-1667 | |
| Medium5.3 | Missing Authorization ≤12.4.16Update to 12.4.17 | CVE-2026-52714 | |
| Medium4.3 | Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations ≤12.4.16Update to 12.4.17 | CVE-2026-7624 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection ≤12.4.14Update to 12.4.15 | CVE-2025-14342 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection ≤12.4.03Update to 12.4.06 | CVE-2025-22783 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection via search Parameter ≤12.4.05Update to 12.4.06 | CVE-2025-1768 | |
| Medium4.3 | Missing Authorization ≤12.4.07Update to 12.4.08 | CVE-2025-24654 | |
| Medium4.4 | Authenticated (Editor+) Stored Cross-Site Scripting ≤12.3.20Update to 12.3.21 | CVE-2024-10515 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via url Parameter ≤12.3.19Update to 12.3.20 | CVE-2024-6497 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤12.3.16Update to 12.3.17 | CVE-2024-29790 | |
| Medium4.4 | Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings ≤12.3.15Update to 12.3.16 | CVE-2024-0597 | |
| Medium6.3 | Missing Authorization ≤12.1.20Update to 12.1.21 | CVE-2022-44626 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'page' and 'tab' ≤12.1.20Update to 12.1.21 | CVE-2022-45065 | |
| High8.8 | Authenticated (Contributor+) Arbitrary File Upload ≤12.1.10Update to 12.1.11 | CVE-2022-38140 | |
| Medium6.1 | Reflected Cross-Site Scripting <11.1.12Update to 11.1.12 | CVE-2021-25019 | |
| High7.3 | Missing Authorization Checks <6.1.5Update to 6.1.5 | — | |
| High7.5 | Directory Traversal <6.1.5Update to 6.1.5 | — |
- High7.5Authenticated (Contributor+) PHP Object Injection
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤14.2.2Update to 14.2.3
- Medium6.1Reflected Cross-Site Scripting
≤14.2.0Update to 14.2.1
- High7.2Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()
≤14.0.0Update to 14.0.1
- Medium5.3Missing Authorization
≤12.4.16Update to 12.4.17
- Medium4.3Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations
≤12.4.16Update to 12.4.17
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection
≤12.4.14Update to 12.4.15
- Medium6.5Authenticated (Contributor+) SQL Injection
≤12.4.03Update to 12.4.06
- Medium6.5Authenticated (Subscriber+) SQL Injection via search Parameter
≤12.4.05Update to 12.4.06
- Medium4.3Missing Authorization
≤12.4.07Update to 12.4.08
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤12.3.20Update to 12.3.21
- High8.8Authenticated (Contributor+) SQL Injection via url Parameter
≤12.3.19Update to 12.3.20
- Medium6.1Reflected Cross-Site Scripting
≤12.3.16Update to 12.3.17
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
≤12.3.15Update to 12.3.16
- Medium6.3Missing Authorization
≤12.1.20Update to 12.1.21
- Medium6.1Reflected Cross-Site Scripting via 'page' and 'tab'
≤12.1.20Update to 12.1.21
- High8.8Authenticated (Contributor+) Arbitrary File Upload
≤12.1.10Update to 12.1.11
- Medium6.1Reflected Cross-Site Scripting
<11.1.12Update to 11.1.12
- High7.3Missing Authorization Checks
<6.1.5Update to 6.1.5
- High7.5Directory Traversal
<6.1.5Update to 6.1.5
GEO Plugin by Squirrly SEO: common questions
Does GEO Plugin by Squirrly SEO have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in GEO Plugin by Squirrly SEO: 7 high, 13 medium. None are known to affect version null.
How do I check which version of GEO Plugin by Squirrly SEO I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent GEO Plugin by Squirrly SEO vulnerability?
CVE-2026-94076, published Sep 24, 2026: GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection. Severity: High (CVSS 7.5).
Is any GEO Plugin by Squirrly SEO vulnerability listed in CISA KEV?
No. None of the known GEO Plugin by Squirrly SEO vulnerabilities is currently listed in the CISA KEV catalog.