CVE-2026-115954
MediumCVSS 5.4Summary
The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could perform unauthorized actions within the plugin, potentially leading to data modification or unauthorized access to functionality.
Recommendation
Update the Geo Mashup plugin to a version later than 1.13.22 and review the permission configuration.
Other vulnerabilities in Geo Mashup
See all- CVE-2026-115953Medium
The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
- CVE-2026-97250High
The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-78294Medium
Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.
- CVE-2026-66450High
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-66449High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
- CVE-2026-48967High
There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.
- CVE-2026-42734High
CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.
- CVE-2026-27427Medium
The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS