Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · cf-geoplugin
Geo Controller
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 27, 2026Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.CVE-2026-78286 · affects up to 8.9.8 · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
Jan 5, 2026Geo Controller: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-51513 · affects up to 8.5.2 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS.This issue affects Geo Controller: from n/a through 8.5.2.
Dec 9, 2025Geo Controller: Insertion of Sensitive Information Into Sent DataCVE-2025-62109 · affects up to 8.9.4 · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.
Sep 5, 2024Geo Controller: Unauthorized shortcode executionCVE-2024-7381 · affects up to 8.6.9 · reported by WordfenceMedium 5.3
The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.
Sep 5, 2024Geo Controller: Unauthorized menu creation/deletionCVE-2024-7380 · affects up to 8.7.3 · reported by WordfenceMedium 4.3
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.
May 1, 2024Geo Controller: Unserializes user input via some of its AJAX actions and REST API routesCVE-2024-3591 · fixed in 8.6.5 · reported by WPScanMedium 6.5
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Mar 29, 2024Geo Controller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30451 · affects up to 8.6.4 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.
Mar 28, 2024Geo Controller: Deserialization of Untrusted DataCVE-2024-30227 · affects up to 8.6.4 · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.