Geo Mashup

Geo Mashup has 24 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 24 are fixed as of October 2026. Their average CVSS score is 6.6, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 9 high. 2026 was the busiest year with 17 disclosures.

The most common weakness is Cross-Site Scripting, behind 13 of the records (54%). Other recurring categories include SQL Injection, Missing Authorization.

Every one of the 24 issues recorded for Geo Mashup has a vendor fix available, so running the current release closes all known holes.

19 independent researchers contributed these findings, most of them (3) reported by Naoya Takahashi (nakko). Geo Mashup is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891015.11.2005Today27.01.20156.1Geo Mashup < 1.8.3 - Cross-Site Scripting CVSS 6.1 · 27.01.201516.07.20186.4Geo Mashup - < 1.10.4 - Cross-Site Scripting CVSS 6.4 · 16.07.201804.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202218.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202316.09.20246.5Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.5 · 16.09.202430.09.20246.4Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode CVSS 6.4 · 30.09.202425.07.20258.1Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion CVSS 8.1 · 25.07.202524.02.20267.5Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter CVSS 7.5 · 24.02.202630.04.20266.1Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 6.1 · 30.04.202601.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter CVSS 7.5 · 01.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter CVSS 7.5 · 01.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter CVSS 7.5 · 01.05.20266.5Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter CVSS 6.5 · 01.05.202626.05.20267.2Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 26.05.20266.4Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 26.05.202627.05.20265.3Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter CVSS 5.3 · 27.05.202603.06.20266.5Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 03.06.202607.08.20267.2Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 07.08.20268.1Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion CVSS 8.1 · 07.08.202616.09.20266.4Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.09.202629.09.20267.2Geo Mashup <= 1.13.21 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 29.09.202619.10.20266.1Geo Mashup <= 1.13.22 - Reflected Cross-Site Scripting CVSS 6.1 · 19.10.202626.10.20264.3Geo Mashup <= 1.13.22 - Missing Authorization CVSS 4.3 · 26.10.20266.4Geo Mashup <= 1.13.22 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 26.10.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

24

Get automatic notifications for all Geo Mashup vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-66450

Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

24 records
Showing 1–10 of 24 reports
Geo Mashup banner
Latestv1.13.23
4.7(33)
94/100
Last Updated
2026-09-20 (1mo ago)
Active Installs
1,000+
Downloads
255,512
Requires WP
3.7+
Requires PHP
0+
Tested up to
WP 7.1.3
Created
2005-11-15 (21y ago)

This plugin lets you save location information with posts, pages, and other WordPress objects. These can then be presented on interactive maps in many ways. Key Features Geo Mashup, like WordPress, has a simple interface for basic features, templates for control of output, and APIs for endless customization options. Some popular features are: Use different map providers: Google Maps v3, OpenLayers, Leaflet Global maps can present your posts in many ways They can show just one category, custom taxonomy term, or custom post type, for example Clicking on a post marker shows a customizable summary of the post or page in an info window A Geo Search widget enables searching for content by distance from a search location Marker clustering for Google maps Location can be saved for all post types (including pages) users, and comments Synchronize Geodata with the Geo location mobile client and other plugins Support for both standard WordPress shortcodes and template tags to add maps to your site. Reverse geocoding to fill in address information for locations GeoRSS automatically added to feeds Attach KML files to posts and pages Connect category markers with a colored line If you need features that are aren’t listed here, check the documentation and the tag reference. Translations Belarussian by hrank added in version 1.11.0 Ukranian by Ivanka of Everycloudtech updated in version 1.8.6 Dutch by delicatesther updated in version 1.8.5 German by Thomas Morvay added in version 1.5.4 Slovak by B. Radenovich of Web Hosting Watch updated in version 1.5.4 Romanian by Florin Dumitru added in version 1.5 Irish by Vikas Arora added in version 1.4.11 Russian by Tony added in version 1.4.10 Hindi by Outshine Solutions added in version 1.4.9 Polish by Kamil added in version 1.4.7 Portugese by Antonio Xeira added in version 1.4.2 Italian by Federico added in version 1.3.10 French updated in version 1.3.7 Spanish by Reven added in version 1.3.3 Swedish by Joakim Green added in version 1.3.3 Translators welcome. Mashup Ingredients Geo Mashup combines WordPress, Google Maps, OpenStreetMap, and GeoNames to create a GeoCMS that puts you in control of all your content, including geographic data. Thanks for security reports to: JunHee Cho Leonid Semenenko Asim Alshaya she11f Baikuya daroo Naoya Takahashi (nakko) Muhammad Yudha – DJ Nabil Irawan Dimas Maulana Peter Thaleikis of Wordfence LVT-tholv2k at patchstack Abhinav Mishra Alex Chepovetsky Maxim Lemberg You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C