CVE-2026-2416

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 25, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-241607.5NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer derefereCVE-2026-241627.8NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A succeCVE-2026-241639.8NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successCVE-2026-241649.8NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerabiCVE-2026-241658.8NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerabiCVE-2026-241665.1NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic kCVE-2026-241676.8NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands CVE-2026-241686.8NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may causeCVE-2026-241698.0NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject coCVE-2026-24179.3A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow aCVE-2026-241708.8NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeCVE-2026-241737.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the s
CVE-2026-2416: High severity, CVSS 7.5 | Vulnix