{"id":"CVE-2026-115953","kind":"vulnerability","aliases":["CVE-2026-115953"],"related":[],"title":"Geo Mashup WordPress plugin: stored XSS through version 1.13.22","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Stored XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn fails to neutralize input before it is rendered in a page, allowing stored cross-site scripting. An attacker who can store content that the plugin later outputs can run JavaScript in a visitor's or administrator's browser.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geo-mashup","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Geo Mashup version in the WordPress admin plugin list or with `wp plugin get geo-mashup --field=version`\n- Compare the result against the affected range, which runs through `1.13.22`","fix":"- Update Geo Mashup to a release later than `1.13.22` once the vendor ships a patched version (unknown from the sources)\n- Until patched, unknown whether disabling the plugin or restricting contributor-level input is sufficient","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:05+00:00","updated_at":"2026-10-26T11:31:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update Geo Mashup to a release later than `1.13.22` once the vendor ships a patched version (unknown from the sources)\n- Until patched, unknown whether disabling the plugin or restricting contributor-level input is sufficient","reach":"internet","title":"Geo Mashup WordPress plugin: stored XSS through version 1.13.22","impact":"medium","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn fails to neutralize input before it is rendered in a page, allowing stored cross-site scripting. An attacker who can store content that the plugin later outputs can run JavaScript in a visitor's or administrator's browser.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","geo-mashup"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitor or admin browsers, stealing sessions","analyst_note":"Confirm the patched version and the minimum role needed to store the payload; check the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed Geo Mashup version in the WordPress admin plugin list or with `wp plugin get geo-mashup --field=version`\n- Compare the result against the affected range, which runs through `1.13.22`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Geo Mashup WordPress plugin at version 1.13.22 or earlier. The sources do not say which plugin features or user roles are needed to store the payload, so the exposure path is unknown. Sites without this plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3325,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115953':12A,15A '-2026':11A,14A '1.13.22':9A,102C 'administr':68B 'affect':96C 'allow':43B,92C 'attack':50B 'browser':70B 'content':54B 'cross':46B,80C 'cross-sit':45B,79C 'cve':10A,13A 'dylan':30B,85C 'fail':32B 'generat':78C 'geo':1A,17B,25B,87C,90C,97C 'geo-mashup':16B,89C 'improp':71C 'input':35B,74C 'issu':95C 'javascript':62B 'kuhn':31B,86C 'later':58B 'mashup':2A,18B,26B,88C,91C,98C 'n/a':100C 'neutral':34B,72C 'output':59B 'packag':19B 'page':42B,77C 'plugin':4A,23B,28B,57B 'render':39B 'run':61B 'script':48B,82C 'site':47B,81C 'store':5A,44B,53B,93C 'version':8A 'visitor':65B 'vulner':83C 'web':76C 'wordpress':3A,20B,22B,27B 'wordpress-plugin':21B 'xss':6A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Geo Mashup WordPress plugin at version 1.13.22 or earlier. The sources do not say which plugin features or user roles are needed to store the payload, so the exposure path is unknown. Sites without this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115953","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}