{"id":"CVE-2026-113487","kind":"vulnerability","aliases":["CVE-2026-113487"],"related":[],"title":"GeoDirectory WordPress plugin: stored XSS via post badge link","description":"The GeoDirectory  WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.","summary":"The GeoDirectory WordPress plugin before 2.8.196 does not sanitise or escape a post badge click-through link before printing it in an anchor on listings. A contributor-level user can store a script there that runs in the browser of higher-privileged users who view the listing, such as an administrator reviewing content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-updated"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen, or with `wp plugin get geodirectory --field=version`\n- unknown","fix":"- Update the GeoDirectory plugin to `2.8.196` or later\n- unknown","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:28+00:00","updated_at":"2026-10-28T06:32:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.196` or later\n- unknown","reach":"internet","title":"GeoDirectory WordPress plugin: stored XSS via post badge link","impact":"medium","summary":"The GeoDirectory WordPress plugin before 2.8.196 does not sanitise or escape a post badge click-through link before printing it in an anchor on listings. A contributor-level user can store a script there that runs in the browser of higher-privileged users who view the listing, such as an administrator reviewing content.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Stored script runs in administrator sessions, enabling account takeover","analyst_note":"","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen, or with `wp plugin get geodirectory --field=version`\n- unknown","needs_analyst":false,"not_affected_if":["plugin-updated","no-contributor-accounts"],"who_is_affected":"Sites running the GeoDirectory plugin before `2.8.196` that allow Contributor or higher accounts to create listings with post badges. The risk is highest where administrators or editors review listings in the same WordPress install. Sites without GeoDirectory, or with it already updated, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3334,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113487':12A,15A '-2026':11A,14A '2.8.196':27B,83C 'administr':75B,135C 'allow':108C 'anchor':45B,103C 'attack':123C 'badg':8A,35B,92C 'browser':62B 'click':37B,94C 'click-through':36B,93C 'content':77B,138C 'contributor':50B,112C 'contributor-level':49B 'cross':120C 'cross-sit':119C 'cve':10A,13A 'element':104C 'escap':32B,89C 'geodirectori':1A,16B,23B,79C 'higher':65B,126C 'higher-privileg':64B,125C 'host':20B 'includ':133C 'level':51B 'link':9A,39B,96C 'list':47B,71B,107C,132C 'moder':137C 'output':99C 'packag':17B 'perform':117C 'plugin':3A,25B,81C 'post':7A,34B,91C 'print':41B 'privileg':66B,127C 'proper':86C 'review':76B,136C 'role':113C 'run':59B 'sanitis':30B,87C 'script':56B,122C 'self':19B 'self-host':18B 'site':121C 'store':4A,54B,118C 'user':52B,67B,109C,128C 'valu':97C 'via':6A 'view':69B,130C 'wordpress':2A,21B,24B,80C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory plugin before `2.8.196` that allow Contributor or higher accounts to create listings with post badges. The risk is highest where administrators or editors review listings in the same WordPress install. Sites without GeoDirectory, or with it already updated, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113487","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}