Description

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:06.017Z",
  "pubdate": "2026-08-13T14:17:06.017Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Geo Mashup plugin for WordPress in versions 1.13.18 and prior. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the application.\nThe primary impact of this vulnerability is the potential execution of arbitrary JavaScript in the context of a victim's browser session. When a user navigates to a compromised page or interacts with crafted parameters, the injected payload executes, enabling threat actors to hijack user sessions, steal sensitive authentication cookies, redirect users to malicious destinations, or deface the affected web interface.\nThe affected product is the Geo Mashup plugin up to version 1.13.18. Risk implications are elevated due to the unauthenticated nature of the attack vector, meaning no prior access, privileges, or user interaction beyond visiting a malicious link is required for successful exploitation.\nAttackers require network access to the target web application to deliver the payload. Successful exploitation highlights a deficiency in input sanitization and output encoding within the vulnerable software components, necessitating immediate remediation to prevent client-side compromise.",
  "technicalDetails": "The vulnerability stems from insufficient sanitization of user-supplied input and inadequate output encoding within the Geo Mashup plugin. Specifically, parameters processed by the plugin are reflected directly into the Document Object Model (DOM) without proper validation, allowing malicious script tags or event handlers to be interpreted and executed by the victim's browser.\nThe affected component resides within the Geo Mashup plugin code base impacting versions 1.13.18 and prior. The vulnerability is classified as Cross-Site Scripting (XSS), operating via an unauthenticated network vector. No authentication or specific user privileges are required to initiate the attack sequence, exposing public-facing endpoints to remote exploitation.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTTP request containing a payload, such as a JavaScript execution string (e.g., <script>alert(document.cookie)</script>), injected into vulnerable input parameters handled by Geo Mashup. Second, the attacker induces an unauthenticated victim to click a specially crafted URL or visit a compromised page leveraging these parameters. Third, the server processes the request and reflects the unsanitized input back within the HTTP response. Fourth, the victim's browser parses the response, fails to encode the malicious characters, and executes the script within the security context of the victim's session.\nThe payload behavior involves executing arbitrary code within the victim's browser, granting the attacker the ability to interact with the DOM, access local storage, extract session tokens, and perform unauthorized actions on behalf of the authenticated user. Post-exploitation impact depends on the privileges of the targeted user, ranging from standard user account compromise to administrative session takeover if an administrator views the malicious payload."
}