Live › vulnerability › CVE-2026-115953
Go to dashboardThe Geo Mashup WordPress plugin by Dylan Kuhn fails to neutralize input before it is rendered in a page, allowing stored cross-site scripting. An attacker who can store content that the plugin later outputs can run JavaScript in a visitor's or administrator's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Sites running the Geo Mashup WordPress plugin at version 1.13.22 or earlier. The sources do not say which plugin features or user roles are needed to store the payload, so the exposure path is unknown. Sites without this plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get geo-mashup --field=version1.13.221.13.22 once the vendor ships a patched version (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
This page as .md · .json · in your agent: get_signal("CVE-2026-115953")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.