{"id":"CVE-2026-111848","kind":"vulnerability","aliases":["CVE-2026-111848"],"related":[],"title":"Geo Mashup WordPress plugin: reflected XSS through 1.13.22","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn does not neutralize input in some page output, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geo-mashup","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Geo Mashup plugin version in the WordPress admin under Plugins, or with `wp plugin get geo-mashup --field=version`\n- unknown for other checks; the sources do not name the affected parameter or endpoint","fix":"- Update Geo Mashup to a version later than `1.13.22`\n- unknown for a patched version number; the sources do not give one","status":"open","published_at":"2026-10-21T15:17:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:48+00:00","updated_at":"2026-10-25T03:31:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update Geo Mashup to a version later than `1.13.22`\n- unknown for a patched version number; the sources do not give one","reach":"internet","title":"Geo Mashup WordPress plugin: reflected XSS through 1.13.22","impact":"medium","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn does not neutralize input in some page output, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","geo-mashup"],"confidence":0.6,"needs_auth":"no","worst_case":"script runs in visitor browsers, session cookies or actions can be stolen","analyst_note":"Confirm the fixed version and the vulnerable parameter from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111848 and the plugin's changelog.","how_to_check":"- Check the installed Geo Mashup plugin version in the WordPress admin under Plugins, or with `wp plugin get geo-mashup --field=version`\n- unknown for other checks; the sources do not name the affected parameter or endpoint","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Geo Mashup WordPress plugin at version 1.13.22 or earlier. The sources do not say which page or parameter is reachable, so any site with the plugin active should be treated as potentially exposed. Sites that have removed the plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3365,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111848':11A,14A '-2026':10A,13A '1.13.22':8A,94C 'affect':88C 'allow':84C 'attack':46B 'browser':54B 'craft':61B 'cross':42B,72C 'cross-sit':41B,71C 'cve':9A,12A 'dylan':29B,77C 'enabl':39B 'generat':70C 'geo':1A,16B,24B,79C,82C,89C 'geo-mashup':15B,81C 'improp':63C 'input':34B,66C 'issu':87C 'kuhn':30B,78C 'link':62B 'mashup':2A,17B,25B,80C,83C,90C 'n/a':92C 'neutral':33B,64C 'open':59B 'output':38B 'packag':18B 'page':37B,69C 'plugin':4A,22B,27B 'reflect':5A,40B,85C 'run':48B 'script':44B,49B,74C 'site':43B,73C 'trick':56B 'visitor':52B 'vulner':75C 'web':68C 'wordpress':3A,19B,21B,26B 'wordpress-plugin':20B 'xss':6A 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Geo Mashup WordPress plugin at version 1.13.22 or earlier. The sources do not say which page or parameter is reachable, so any site with the plugin active should be treated as potentially exposed. Sites that have removed the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111848","severity":null,"published_at":"2026-10-21T15:17:16+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111848","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111848","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}