Vendor
The GEO my WordPress plugin (versions 4.5.5.3 and earlier) is vulnerable to unauthenticated PHP object injection.