The vulnerability is an unauthenticated Cross‑Site Scripting flaw present in Geo Mashup plugin versions 1.13.18 and earlier. The flaw exists because the plugin fails to properly escape user‑controlled input before rendering it in the page, allowing a malicious actor to inject arbitrary JavaScript code. The resulting cross‑site scripting can lead to session hijacking, data theft, malicious redirection, or defacement of the site, and is catalogued as CWE‑79.

WordPress sites that use the Geo Mashup plugin by Dylan Kuhn with a version equal to or lower than 1.13.18 are affected. No other plugins or WordPress core components are directly implicated; site owners must confirm the plugin version and upgrade if necessary.

The CVSS score of 7.1 reflects a high impact risk, and the lack of authentication requirement makes the vulnerability readily exploitable by anyone who can access the plugin’s exposed output. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog at this time. Without a patch, attackers can inject scripts simply by visiting a crafted URL or by interacting with the plugin’s interface, making the threat significant. Updating the plugin removes the flaw, but until the update is deployed the risk remains.