CVE-2023-5467 in GEO my Plugin
Summary
by MITRE • 10/25/2023
The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-5467 affects the GEO my WordPress plugin, a popular geographic information system integration tool for WordPress websites. This security flaw exists in plugin versions up to and including 4.0, representing a significant risk to WordPress installations that rely on geographic data functionality. The vulnerability stems from inadequate input validation and output sanitization mechanisms within the plugin's shortcode processing capabilities, creating a persistent security gap that can be exploited by malicious actors with relatively low privileges.
The technical implementation of this vulnerability resides in the plugin's handling of user-supplied attributes within shortcodes, which are essentially predefined code snippets used to display dynamic content. When administrators or contributors create or modify content using these shortcodes, the plugin fails to properly sanitize the input parameters before storing them in the database. This stored data is then retrieved and rendered without adequate output escaping, creating a classic stored cross-site scripting condition. The vulnerability specifically targets the plugin's shortcode processing engine, which interprets user-provided parameters and incorporates them into generated HTML output, allowing malicious script payloads to be permanently embedded in the website's content.
Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability to inject malicious JavaScript code through the shortcode attributes, which will execute whenever any user accesses pages containing the injected content. This creates a persistent threat vector where compromised pages become attack vectors for further exploitation, potentially enabling session hijacking, credential theft, or redirection to malicious sites. The impact extends beyond simple script execution as it allows attackers to leverage the privileges of the targeted users, potentially escalating to administrator-level access if the compromised user has elevated permissions. This vulnerability directly maps to CWE-79, which defines Cross-Site Scripting (XSS) as a weakness where untrusted data is used to generate web content without proper sanitization, and aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments or links, as the malicious scripts could be used to redirect users to phishing sites or download additional malware.
The operational impact of this vulnerability is substantial as it allows attackers to maintain persistent access to compromised WordPress installations without requiring additional authentication or complex exploitation techniques. Once the malicious script is injected, it executes automatically every time users access affected pages, making detection more difficult and potentially allowing for long-term surveillance or data exfiltration activities. Organizations using the GEO my WordPress plugin should immediately implement mitigations including updating to the latest plugin version, implementing strict input validation on shortcode attributes, and conducting comprehensive security audits of existing content to identify any previously injected malicious scripts. Additionally, administrators should review user permissions and implement principle of least privilege to limit the potential damage from compromised accounts, while monitoring for unusual activity patterns that might indicate exploitation attempts.