PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27427 Dylan Kuhn CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the Geo Mashup WordPress plugin, affecting versions up to and including 1.13.18. The flaw stems from improper neutralization of input during web page generation (CWE-79), allowing authenticated attackers with low privileges to inject malicious scripts that execute in victims' browsers. The vulnerability was disclosed on May 26, 2026, with NVD analysis subsequently deferred. No known exploitation in ransomware campaigns has been reported.

Vendor
Dylan Kuhn
Product
Geo Mashup
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

WordPress site administrators using Geo Mashup plugin; security teams managing WordPress content management systems; developers maintaining custom Geo Mashup integrations

Technical summary

The Geo Mashup plugin fails to properly sanitize user-supplied input before rendering it in web pages, resulting in a stored XSS vulnerability (CWE-79). Attackers with low-privilege authenticated access can persist malicious JavaScript payloads that execute when other users view affected content. The CVSS 3.1 score of 6.5 reflects network attack vector, low attack complexity, low privileges required, user interaction needed, and changed scope with low impacts to confidentiality, integrity, and availability.

Defensive priority

medium

Recommended defensive actions

  • Update Geo Mashup plugin to version 1.13.19 or later if available
  • Review plugin settings and user role permissions to limit untrusted content submission
  • Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Conduct code review of custom Geo Mashup implementations for additional input sanitization
  • Monitor for plugin updates through WordPress admin dashboard or vendor security advisories

Evidence notes

Vulnerability identified in Geo Mashup plugin versions through 1.13.18. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. Source references Patchstack advisory.

Official resources

2026-05-26