Geo Mashup

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Geo Mashup

Information

Software Type Plugin
Software Slug geo-mashup (view on wordpress.org)
Software Status Active
Software Author cyberhobo
Software Website wordpress.org
Software Downloads 251,268
Software Active Installs 1,000
Software Record Last Updated July 13, 2026

17 Vulnerabilities

Submit a Vulnerability
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-48967
Jun 3, 2026
Researcher: Jonathan Dersch
Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
5.3
CVE-2026-7552
May 27, 2026
Researcher: t0ann9uy3n
Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-42734
May 26, 2026
Researcher: she11f
Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-27427
May 26, 2026
Researcher: Muhammad Yudha - DJ
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
6.5
CVE-2026-6457
May 1, 2026
Researcher: Leonid Semenenko (lsemenenko)
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
7.5
CVE-2026-4062
May 1, 2026
Researcher: Naoya Takahashi (nakko)
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
7.5
CVE-2026-4061
May 1, 2026
Researcher: Naoya Takahashi (nakko)
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
7.5
CVE-2026-4060
May 1, 2026
Researcher: Naoya Takahashi (nakko)
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
7.5
CVE-2026-2416
Feb 24, 2026
Researcher: Nabil Irawan
Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion
8.1
CVE-2025-48293
Jul 25, 2025
Researcher: Dimas Maulana
Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode
6.4
CVE-2024-8990
Sep 30, 2024
Researcher: Peter Thaleikis
Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.5
CVE-2024-44008
Sep 16, 2024
Researcher: LVT-tholv2k
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Freemius SDK <= 2.4.2 - Missing Authorization Checks
6.3
CVE-2022-4974
Mar 4, 2022
Researchers:
Geo Mashup - < 1.10.4 - Cross-Site Scripting
6.4
CVE-2018-14071
Jul 16, 2018
Researcher: cyberhobo
Geo Mashup < 1.8.3 - Cross-Site Scripting
6.1
CVE-2015-1383
Jan 27, 2015
Researcher: Paolo Perego
Title Status CVE ID CVSS Researchers Date
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-48967 6.5 Jonathan Dersch June 3, 2026
Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter Patched CVE-2026-7552 5.3 t0ann9uy3n May 27, 2026
Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-42734 7.2 she11f May 26, 2026
Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-27427 6.4 Muhammad Yudha - DJ May 26, 2026
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter Patched CVE-2026-6457 6.5 Leonid Semenenko (lsemenenko) May 1, 2026
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter Patched CVE-2026-4062 7.5 Naoya Takahashi (nakko) May 1, 2026
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter Patched CVE-2026-4061 7.5 Naoya Takahashi (nakko) May 1, 2026
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter Patched CVE-2026-4060 7.5 Naoya Takahashi (nakko) May 1, 2026
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Patched CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter Patched CVE-2026-2416 7.5 Nabil Irawan February 24, 2026
Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion Patched CVE-2025-48293 8.1 Dimas Maulana July 25, 2025
Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode Patched CVE-2024-8990 6.4 Peter Thaleikis September 30, 2024
Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-44008 6.5 LVT-tholv2k September 16, 2024
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Patched CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
Freemius SDK <= 2.4.2 - Missing Authorization Checks Patched CVE-2022-4974 6.3 March 4, 2022
Geo Mashup - < 1.10.4 - Cross-Site Scripting Patched CVE-2018-14071 6.4 cyberhobo July 16, 2018
Geo Mashup < 1.8.3 - Cross-Site Scripting Patched CVE-2015-1383 6.1 Paolo Perego January 27, 2015

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation