Geo Mashup
Geo Mashup has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 8 high. 2026 was the busiest year with 12 disclosures.
The most common weakness is Cross-Site Scripting, behind 9 of the records (47%). Other recurring categories include SQL Injection, Missing Authorization.
Every one of the 19 issues recorded for Geo Mashup has a vendor fix available, so running the current release closes all known holes.
15 independent researchers contributed these findings, most of them (3) reported by Naoya Takahashi (nakko). Geo Mashup is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-66450Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records

Geo Mashup
Author
Dylan Kuhn
This plugin lets you save location information with posts, pages, and other WordPress objects. These can then be presented on interactive maps in many ways. Key Features Geo Mashup, like WordPress, has a simple interface for basic features, templates for control of output, and APIs for endless customization options. Some popular features are: Use different map providers: Google Maps v3, OpenLayers, Leaflet Global maps can present your posts in many ways They can show just one category, custom taxonomy term, or custom post type, for example Clicking on a post marker shows a customizable summary of the post or page in an info window A Geo Search widget enables searching for content by distance from a search location Marker clustering for Google maps Location can be saved for all post types (including pages) users, and comments Synchronize Geodata with the Geo location mobile client and other plugins Support for both standard WordPress shortcodes and template tags to add maps to your site. Reverse geocoding to fill in address information for locations GeoRSS automatically added to feeds Attach KML files to posts and pages Connect category markers with a colored line If you need features that are aren’t listed here, check the documentation and the tag reference. Translations Belarussian by hrank added in version 1.11.0 Ukranian by Ivanka of Everycloudtech updated in version 1.8.6 Dutch by delicatesther updated in version 1.8.5 German by Thomas Morvay added in version 1.5.4 Slovak by B. Radenovich of Web Hosting Watch updated in version 1.5.4 Romanian by Florin Dumitru added in version 1.5 Irish by Vikas Arora added in version 1.4.11 Russian by Tony added in version 1.4.10 Hindi by Outshine Solutions added in version 1.4.9 Polish by Kamil added in version 1.4.7 Portugese by Antonio Xeira added in version 1.4.2 Italian by Federico added in version 1.3.10 French updated in version 1.3.7 Spanish by Reven added in version 1.3.3 Swedish by Joakim Green added in version 1.3.3 Translators welcome. Mashup Ingredients Geo Mashup combines WordPress, Google Maps, OpenStreetMap, and GeoNames to create a GeoCMS that puts you in control of all your content, including geographic data. Thanks for security reports to: Leonid Semenenko she11f Baikuya daroo Naoya Takahashi (nakko) Muhammad Yudha – DJ Nabil Irawan Dimas Maulana Peter Thaleikis of Wordfence LVT-tholv2k at patchstack Abhinav Mishra Alex Chepovetsky Maxim Lemberg You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C