My Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeo_city' shortcode in all versions up to, and including, 1.2. This is due to the plugin not properly sanitizing user input or escaping output of the 'default' shortcode attribute. This makes it possible for authenticated...
- CVSS:
- 6.4
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Nov 10, 2025
CVE-2025-11863 on NVD →
My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection
critical
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present...
- CVSS:
- 9.8
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Nov 15, 2024
CVE-2024-52433 on NVD →
My Geo Posts Free <= 1.2 - PHP Object Injection
critical
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it coul...
- CVSS:
- 9.8
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Apr 27, 2017
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database