PT-2026-8075
CVE-2026-1792
·
Published
2026-02-13
·
Updated
2026-02-14
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Geo Widget versions prior to 1.1
Description
The Geo Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the URL path. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.
Recommendations
Update the Geo Widget plugin to version 1.1 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾