Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows… (CVE-2026-111848)

The Dylan Kuhn Geo Mashup plugin suffers from a reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw affects all versions up to and including 1.13.22. An attacker can exploit this vulnerability by crafting malicious input that is reflected in the web page without proper sanitization, leading to script execution in the context of the victim's browser session.

Successful exploitation can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means an attacker could potentially steal sensitive information, manipulate content, or disrupt availability within the scope of the affected web application.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and output encoding workarounds or disabling the plugin if feasible.