The vulnerability is an improper neutralization of user input during page generation, leading to stored cross‑site scripting. An attacker can inject malicious scripts that will execute in the browsers of any user who views the compromised page, potentially allowing session hijacking, cookie theft, defacement, or the delivery of additional malware. This flaw is assigned to CWE‑79, indicating a failure to sanitize inputs.

The flaw affects the Geo Mashup plugin for WordPress, created by Dylan Kuhn. All releases from the earliest available version through 1.13.22 are vulnerable. WordPress sites that have installed any of these versions of the plugin are impacted.

The CVSS score is 6.5, placing the defect in the moderate severity range. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to inject payloads through the plugin’s content entry interface; an authenticated user with content‑creation rights can cause the payload to be stored. Once stored, the payload will run in the browsers of all users who view the affected content, making the risk real for sites that expose such content to visitors.