The Geo Widget WordPress plugin by owencutajar suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the URL path input is not adequately sanitized or escaped, enabling attackers to inject malicious scripts that persist and execute in the context of users visiting the compromised pages. This affects all versions up to 1.0. The vulnerability has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the Geo Widget plugin, which execute when users visit those pages. This can lead to partial confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect system availability. The vulnerability requires user interaction (visiting the injected page) and has a medium severity rating.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates. Until a patch is available, consider disabling or removing the Geo Widget plugin to prevent exploitation. Avoid visiting or sharing URLs that may contain malicious payloads related to this plugin.