Geo Mashup

Geo Mashup has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 8 high. 2026 was the busiest year with 12 disclosures.

The most common weakness is Cross-Site Scripting, behind 9 of the records (47%). Other recurring categories include SQL Injection, Missing Authorization.

Every one of the 19 issues recorded for Geo Mashup has a vendor fix available, so running the current release closes all known holes.

15 independent researchers contributed these findings, most of them (3) reported by Naoya Takahashi (nakko). Geo Mashup is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

01234567891015.11.2005Today27.01.20156.1Geo Mashup < 1.8.3 - Cross-Site Scripting CVSS 6.1 · 27.01.201516.07.20186.4Geo Mashup - < 1.10.4 - Cross-Site Scripting CVSS 6.4 · 16.07.201804.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202218.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202316.09.20246.5Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.5 · 16.09.202430.09.20246.4Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode CVSS 6.4 · 30.09.202425.07.20258.1Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion CVSS 8.1 · 25.07.202524.02.20267.5Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter CVSS 7.5 · 24.02.202630.04.20266.1Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 6.1 · 30.04.202601.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter CVSS 7.5 · 01.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter CVSS 7.5 · 01.05.20267.5Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter CVSS 7.5 · 01.05.20266.5Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter CVSS 6.5 · 01.05.202626.05.20266.4Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 26.05.20267.2Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 26.05.202627.05.20265.3Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter CVSS 5.3 · 27.05.202603.06.20266.5Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 03.06.202607.08.20267.2Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 07.08.20268.1Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion CVSS 8.1 · 07.08.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

19

Get automatic notifications for all Geo Mashup vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-66450

Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

19 records
2026-08-07 00:00CVE-2026-66449
7.2
High
darooYes
2026-08-07 00:00CVE-2026-66450
8.1
High
darooYes
2026-06-03 00:00CVE-2026-48967
6.5
Medium
Jonathan DerschYes
2026-05-27 18:02CVE-2026-7552
5.3
Medium
t0ann9uy3nYes
2026-05-26 00:00CVE-2026-27427
6.4
Medium
Muhammad Yudha - DJYes
2026-05-26 00:00CVE-2026-42734
7.2
High
she11fYes
2026-05-01 19:15CVE-2026-6457
6.5
Medium
Leonid Semenenko (lsemenenko)Yes
2026-05-01 00:00CVE-2026-4062
7.5
High
Naoya Takahashi (nakko)Yes
2026-05-01 00:00CVE-2026-4061
7.5
High
Naoya Takahashi (nakko)Yes
2026-05-01 00:00CVE-2026-4060
7.5
High
Naoya Takahashi (nakko)Yes
Showing 1–10 of 19 reports
Geo Mashup banner
Latestv1.13.21
4.7(33)
94/100
Last Updated
2026-05-03 (4mo ago)
Active Installs
1,000+
Downloads
252,257
Requires WP
3.7+
Requires PHP
0+
Tested up to
WP 6.9.7
Created
2005-11-15 (21y ago)

This plugin lets you save location information with posts, pages, and other WordPress objects. These can then be presented on interactive maps in many ways. Key Features Geo Mashup, like WordPress, has a simple interface for basic features, templates for control of output, and APIs for endless customization options. Some popular features are: Use different map providers: Google Maps v3, OpenLayers, Leaflet Global maps can present your posts in many ways They can show just one category, custom taxonomy term, or custom post type, for example Clicking on a post marker shows a customizable summary of the post or page in an info window A Geo Search widget enables searching for content by distance from a search location Marker clustering for Google maps Location can be saved for all post types (including pages) users, and comments Synchronize Geodata with the Geo location mobile client and other plugins Support for both standard WordPress shortcodes and template tags to add maps to your site. Reverse geocoding to fill in address information for locations GeoRSS automatically added to feeds Attach KML files to posts and pages Connect category markers with a colored line If you need features that are aren’t listed here, check the documentation and the tag reference. Translations Belarussian by hrank added in version 1.11.0 Ukranian by Ivanka of Everycloudtech updated in version 1.8.6 Dutch by delicatesther updated in version 1.8.5 German by Thomas Morvay added in version 1.5.4 Slovak by B. Radenovich of Web Hosting Watch updated in version 1.5.4 Romanian by Florin Dumitru added in version 1.5 Irish by Vikas Arora added in version 1.4.11 Russian by Tony added in version 1.4.10 Hindi by Outshine Solutions added in version 1.4.9 Polish by Kamil added in version 1.4.7 Portugese by Antonio Xeira added in version 1.4.2 Italian by Federico added in version 1.3.10 French updated in version 1.3.7 Spanish by Reven added in version 1.3.3 Swedish by Joakim Green added in version 1.3.3 Translators welcome. Mashup Ingredients Geo Mashup combines WordPress, Google Maps, OpenStreetMap, and GeoNames to create a GeoCMS that puts you in control of all your content, including geographic data. Thanks for security reports to: Leonid Semenenko she11f Baikuya daroo Naoya Takahashi (nakko) Muhammad Yudha – DJ Nabil Irawan Dimas Maulana Peter Thaleikis of Wordfence LVT-tholv2k at patchstack Abhinav Mishra Alex Chepovetsky Maxim Lemberg You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C