Vulnerabilities

TI-2026-58531 CVE-2026-85200 · GHSA-6hw9-7gx5-mw88

GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

MEDIUM 47

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03227 Published 2026-09-12 No fix listed CWE-98

TI-2026-12876 CVE-2026-15300 · GHSA-342q-8r84-85cj

GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters

MEDIUM 48

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00622 Published 2026-07-10 No fix listed CWE-89

TI-2026-08553 CVE-2026-9757 · GHSA-823p-x8f9-wj7r

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters

LOW 39

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00344 Published 2026-05-30 No fix listed CWE-89

Vulnerabilities

Filters

GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters

GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters