# CVE-2026-115953: Geo Mashup stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-115953-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115953 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Geo Mashup is a WordPress plugin that displays geographic data on maps. A stored cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that persist in the plugin's data, potentially stealing visitor information or hijacking user accounts when victims view affected content.

Technologies: [Dylan Kuhn Geo Mashup](https://junglewise.ai/threats/technologies/geo-mashup). Vendors: [Dylan Kuhn](https://junglewise.ai/threats/vendors/dylan-kuhn).

## Quick answers

**Is CVE-2026-115953 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115953 being exploited in the wild.

**How severe is CVE-2026-115953?** Medium severity, with a CVSS score of 6.5, published 26 October 2026.

**Which products and versions are affected?** Dylan Kuhn Geo Mashup through 1.13.22.

**Is there a fix for CVE-2026-115953?** Yes: fixed in 1.13.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115953 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115953?** Check whether you run Dylan Kuhn Geo Mashup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.13.23

## Technical details

The Geo Mashup WordPress plugin through version 1.13.22 improperly neutralizes user input during web page generation, allowing stored XSS attacks. Exploitation requires a privileged user to interact with a malicious link or crafted page, but once injected, the malicious script persists and executes for all site visitors accessing the affected content. The vulnerability is fixed in version 1.13.23.

## Affected products

- Dylan Kuhn Geo Mashup through 1.13.22

## Timeline

- 2026-10-26: disclosed
- 2026-10-26: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-cross-site-scripting-xss-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-cross-site-scripting-xss-vulnerability-2?_s_id=cve)

## Related threats

- [Geo Mashup broken access control in pages](https://junglewise.ai/threats/cve-2026-115954-missing-authorization-vulnerability-in-dylan-kuhn-geo-mashup-geo)
- [Geo Mashup reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-111848-improper-neutralization-of-input-during-web-page-generation)
- [Geo Mashup cross-site scripting](https://junglewise.ai/threats/cve-2026-97250-unauthenticated-cross-site-scripting-xss-in-geo-mashup-1-13-21)
- [Dylan Kuhn Geo Mashup SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-48967-dylan-kuhn-geo-mashup-sql-injection-in-wordpress-plugin)
- [Dylan Kuhn Geo Mashup Reflected XSS](https://junglewise.ai/threats/cve-2026-42734-dylan-kuhn-geo-mashup-reflected-xss)