Stored Cross-Site Scripting Vulnerability in Geo Mashup Plugin

CVE-2024-8990

What is CVE-2024-8990?

The Geo Mashup plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability that allows authenticated users, having contributor access and higher, to exploit insufficient input sanitization and output escaping on the 'geo_mashup_visible_posts_list' shortcode. This flaw enables the injection of arbitrary web scripts into pages, which are executed when the page is accessed by users. If not addressed, this weakness can lead to significant security risks, including unauthorized data manipulation and exposure.

References