CVE-2026-66450 WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

EUVD-2026-57872

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

CVE-2026-66449

CVE-2026-66449 : Unauthenticated XSS in WordPress Geo Mashup plugin, affected versions

EUVD-2026-57871

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66450

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

CVE-2026-66449

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66450

CVE-2026-66450 refers to an Unauthenticated Local File Inclusion in the WordPress plugin Geo Mashup, affected versions

CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

PT-2026-71558

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66449: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66450: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

PT-2026-71559

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15830

Django 5.2 before 5.2.17 and 6.0 before 6.0.8 contain a DoS in GeoDjango’s GEOSGeometry when parsing deeply nested GEOMETRYCOLLECTIONs supplied as WKT, WKB, or hex-WKB. The issue triggers unbounded recursion in GEOS, causing a segmentation fault and affecting spatial field lookups and the django....