Live › vulnerability › CVE-2026-113487
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.196 does not sanitise or escape a post badge click-through link before printing it in an anchor on listings. A contributor-level user can store a script there that runs in the browser of higher-privileged users who view the listing, such as an administrator reviewing content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin before 2.8.196 that allow Contributor or higher accounts to create listings with post badges. The risk is highest where administrators or editors review listings in the same WordPress install. Sites without GeoDirectory, or with it already updated, are not affected.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.196 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
This page as .md · .json · in your agent: get_signal("CVE-2026-113487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.