WP GeoNames
WP GeoNames has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for WP GeoNames has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WP GeoNames is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2024-11757WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WP GeoNames
Author
Jacques Malgrange
This lightweight plugin makes it easy to install the millions of GEONAMES Data on your WordPress site. It allows : Install data from one or more file (place & postal code) ; Choose column to install to avoid excessive enlargement of the base ; Choose type of data to install (city, park, road…) ; Remove all the data. Check data in the database. Edit and change datas from Dashboard. Display the places on OpenStreetMap. A shortcode is also available to create a city region and country taxonomy. This plugin will give you plenty of ideas to improve the quality of your website. Official GeoNames website. 1.9.1 05/12/2024 Fix XSS vulnerability in shortcode attributes Fix translation issue with WP 6.7 1.9 18/10/2024 – Fix XSS vulnerability on geoSearch field 1.8 08/02/2022 Update Leaflet 1.7.1. Update SumoSelect 3.4.2. Split admin sidet in a specific file. 1.7 21/03/2020 Fix issue with very long line in Geoname DB. Add nonce. Braces style standardisation in the code. 1.6 14/03/2019 – Add Postal code database. 1.5.1 27/01/2018 – Curl used by default if exists in place of File_Get_Content. 1.5 12/01/2018 – Add tab to edit and change datas. 1.4 24/06/2017 Add Taxonomy. Add shortcode to create taxonomy in the site. Add template to customize the taxonomy form. Ability to download multiple files in one click. Check the database with a taxonomy form and display the place on OpenStreetMap. Multisite. 1.3 09/10/2015 – Fix “Fatal error: Out of memory (allocated xxx) (tried to allocate xxx bytes)”. 07/06/2016 – 1.3.1 – Fix error when reactivate (header already sent…). 1.2 06/08/2015 – Fix installation bug. 1.1 01/12/2014 – Add Ajax hook. 1.0 25/11/2014 – First stable version.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C