The Geo Widget plugin for WordPress stores malicious scripts through an unsanitized URL path, allowing an unauthenticated attacker to embed arbitrary JavaScript that executes whenever a user visits the affected page. This stored Cross‑Site Scripting flaw can lead to session hijacking, defacement, or redirection of legitimate users, impacting confidentiality and integrity of the site’s data and user interactions.

All installations of the Geo Widget plugin for WordPress with versions up to and including 1.0 are vulnerable. The vulnerability stems from insufficient input validation and output escaping within the plugin’s URL handling code.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by crafting a malicious URL that contains an injected script and directing victims to that URL; no special privileges are required.