Geo Mashup <= 1.13.18 - SQL Injection
CVE-2026-4060
Verified
Description
Geo Mashup WordPress plugin <= 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
geo_mashup
Published Date
May 4, 2026
Template Author
ydking0911
CVE-2026-4060.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-4060
CWE ID:
cwe-89
Remediation Steps
Update Geo Mashup to the latest version.