WP GeoNames

WP GeoNames has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for WP GeoNames has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. WP GeoNames is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all WP GeoNames vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-11757

WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
WP GeoNames banner
Latestv1.9.2
5.0(2)
100/100
Last Updated
2025-05-02 (1y ago)
Active Installs
100+
Downloads
16,411
Requires WP
3.0.1+
Requires PHP
5.3+
Tested up to
WP 6.7.7
Created
2014-11-27 (12y ago)

This lightweight plugin makes it easy to install the millions of GEONAMES Data on your WordPress site. It allows : Install data from one or more file (place & postal code) ; Choose column to install to avoid excessive enlargement of the base ; Choose type of data to install (city, park, road…) ; Remove all the data. Check data in the database. Edit and change datas from Dashboard. Display the places on OpenStreetMap. A shortcode is also available to create a city region and country taxonomy. This plugin will give you plenty of ideas to improve the quality of your website. Official GeoNames website. 1.9.1 05/12/2024 Fix XSS vulnerability in shortcode attributes Fix translation issue with WP 6.7 1.9 18/10/2024 – Fix XSS vulnerability on geoSearch field 1.8 08/02/2022 Update Leaflet 1.7.1. Update SumoSelect 3.4.2. Split admin sidet in a specific file. 1.7 21/03/2020 Fix issue with very long line in Geoname DB. Add nonce. Braces style standardisation in the code. 1.6 14/03/2019 – Add Postal code database. 1.5.1 27/01/2018 – Curl used by default if exists in place of File_Get_Content. 1.5 12/01/2018 – Add tab to edit and change datas. 1.4 24/06/2017 Add Taxonomy. Add shortcode to create taxonomy in the site. Add template to customize the taxonomy form. Ability to download multiple files in one click. Check the database with a taxonomy form and display the place on OpenStreetMap. Multisite. 1.3 09/10/2015 – Fix “Fatal error: Out of memory (allocated xxx) (tried to allocate xxx bytes)”. 07/06/2016 – 1.3.1 – Fix error when reactivate (header already sent…). 1.2 06/08/2015 – Fix installation bug. 1.1 01/12/2014 – Add Ajax hook. 1.0 25/11/2014 – First stable version.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C