Critical Vulnerability Information Vulnerability Name: Unauthenticated SQL Injection via 'sort' Parameter CVE ID: CVE-2026-2416 CVSS Score: 7.5 (High) Affected Versions: Geo Mashup <= 1.13.17 Fixed Version: 1.13.18 Public Disclosure Date: February 24, 2026 Last Updated: February 25, 2026 Researcher: Nabil Irawan - Heroes Cyber Security Vulnerability Description: The Geo Mashup WordPress plugin is vulnerable to SQL injection via the 'sort' parameter. This issue arises from insufficient escaping of user-supplied parameters and inadequate sanitization of existing SQL queries. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database. Other Related Vulnerabilities Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion: CVE-2025-48293, CVSS 8.1 Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode: CVE-2024-8990, CVSS 6.4 Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting: CVE-2024-44008, CVSS 6.5 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get: CVE-2023-33999, CVSS 6.1 Freemius SDK <= 2.4.2 - Missing Authorization Checks: CVE-2022-4974, CVSS 6.3 Geo Mashup - < 1.10.4 - Cross-Site Scripting: CVE-2018-14071, CVSS 6.4 Geo Mashup < 1.8.3 - Cross-Site Scripting: CVE-2015-1383, CVSS 6.1