Geolocation IP Detection

Geolocation IP Detection has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Geolocation IP Detection has a vendor fix available, so running the current release closes it.

All of these findings were reported by zaim. Geolocation IP Detection is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Geolocation IP Detection vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-57993

Geolocation IP Detection <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Geolocation IP Detection banner
Latestv5.6.4

Geolocation IP Detection

Benjamin Pick

Author

Benjamin Pick

4.7(59)
94/100
Last Updated
2026-06-03 (3mo ago)
Active Installs
20,000+
Downloads
599,304
Requires WP
5.0+
Requires PHP
7.2.5+
Tested up to
WP 7.0.4
Created
2013-07-04 (13y ago)

Provides geographic information detected by an IP adress. This can be used in themes or other plugins, as a shortcode, or via CSS body classes. The city & country names are translated in different languages (supported languages). Features: You can use one of these data sources (see comparison): Free (default source): HostIP.info (IPv4 only) Free with registration: Maxmind GeoIP2 Lite City, automatically updated weekly Commercial: Maxmind GeoIP2 City or Maxmind GeoIP2 Country Commercial Web-API: Maxmind GeoIP2 Precision (City, Country or Insights) Hosting-Provider dependent: Cloudflare or Amazon AWS CloudFront (Country) Free or Commercial Web-API: Ipstack Commercial Web-API via AWS Marketplace: Fastah Provides these 5 functions (see API Documentation): geoip_detect2_get_info_from_ip($ip, $locales = array('en'), $options = array()): Lookup Geo-Information of the specified IP geoip_detect2_get_info_from_current_ip($locales = array('en'), $options = array()): Lookup Geo-Information of the current website user geoip_detect2_get_current_source_description(...): Return a human-readable label of the currently chosen source. geoip_detect2_get_external_ip_adress(): Fetch the internet adress of the webserver geoip_detect2_get_client_ip(): Get client IP (even if it is behind a reverse proxy) For the property names, see the results of a specific IP in the wordpress backend (under Tools > Geolocation IP Detection). You can include these properties into your posts and pages by using the shortcode [geoip_detect2 property="country.name" default="(country could not be detected)" lang="en"] (where &#8216;country.name’ can be one of the other property names as well, and &#8216;default’ and &#8216;lang’ are optional). You can show or hide content by using a shortcode [geoip_detect2_show_if country="FR, DE" not_city="Berlin"]TEXT[/geoip_detect2_show_if]. See Shortcode Documentation. When enabled on the options page, it adds CSS classes to the body tag such as geoip-province-HE, geoip-country-DE and geoip-continent-EU. If you are using a page cache, it is recommended to use the AJAX mode (see AJAX) When enabled on the options page, the client IP respects a reverse proxy of the server. If you are using Contact Form 7, you can use these shortcodes: A select input with all countries, the detected country being selected by default: [geoip_detect2_countries mycountry] A text input that is pre-filled with the detected city (or other property): [geoip_detect2_text_input city property:city lang:fr id:id class:class default:Paris] Geolocation information for the email text: [geoip_detect2_user_info] If you are using WP Forms, you can use this shortcode: Geolocation information for the email text: [geoip_detect2_user_info] Together with SVG Flags you can show the flag of the detected country: [geoip_detect2_current_flag] (see documentation) See Documentation for more info. How can I use these functions? You could choose the currency of the store based on the country name You could pre-fill the shipping country You could show the store nearest to your customer You show or hide content specific to a geographic target group Etc. … You tell me! I’m rather curious what you’ll do with this plugin! Be careful to comply to the applicable laws. For example Regulation (EU) 2018/302 … If you need to get the user’s timezone, it is more accurate to use JS solutions. System Requirements: You will need at least PHP 7.2.5 . Also, if you use the plugin WooCommerce, you’ll need at least WooCommerce 3.9.0 . GDPR: See Is this plugin GDPR-compliant? This extension is “charity-ware”. If you are happy with it, please leave a tip for the benefit of this charity. (See FAQ for more infos.) Here are other ways to contribute to the development of this plugin. This product can provide GeoLite2 data created by MaxMind, available from http://www.maxmind.com. Troubleshooting Does geoip_detect2_get_info_from_current_ip() return the same country, regardless of where you are visiting the site from? Maybe your server has a reverse proxy configured. You can check this: Go to the options page and look for “reverse proxy”. Are there 2 IPs listed there? If so, which one corresponds to your public IP? Or maybe you are using a site cache plugin. Then enable the option Disable caching a page that contains a shortcode or API call to geo-dependent functions. More Troubleshooting Hints

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C