The Geolocation IP Detection plugin by Benjamin Pick contains an improper neutralization of user input during web page generation. The flaw can lead to stored cross‑site scripting, meaning an attacker can inject malicious JavaScript that will be rendered for anyone who visits a page that includes the affected data. The vulnerability is classified as CWE‑79 and can compromise confidentiality and integrity of site users, leading to account takeover, data theft, or defacement.

The flaw exists in all releases of the Geolocation IP Detection plugin up to and including version 5.5.0. WordPress sites that use the plugin Benjamin Pick:Geolocation IP Detection (geoip-detect) and have a version ≤5.5.0 are at risk. No other products or versions are known to be affected.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % shows that the likelihood of a widespread public exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, which suggests no large‑scale exploitation campaigns are currently known. Because the attack requires an attacker to supply malicious input that is stored in the plugin’s database, the attack vector is likely remote via the WordPress admin interface or any input form that the plugin exposes. If exploited, an attacker can execute arbitrary JavaScript in the context of site visitors.