Geo Mashup vulnerabilities

The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Geo Mashup plugin in versions up to and including 1.13.21 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.

Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.

There is a SQL Injection vulnerability in Geo Mashup versions <= 1.13.19 that may allow unauthorized access to the database.

CVE-2026-42734 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in Geo Mashup. The issue affects versions from n/a through 1.13.19.

The Geo Mashup WordPress plugin up to version 1.13.18 contains a Stored Cross-Site Scripting vulnerability due to improper input neutralization during page generation.