Live › vulnerability › CVE-2026-113488
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.196 fails to escape a post badge shortcode attribute placed inside an inline JavaScript event handler. A user with the Contributor role or above can store a script that runs in the browser of anyone who clicks the badge, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin before 2.8.196 where contributors or higher can write content that uses the post badge shortcode. Sites with no contributor-level accounts, or that do not use GeoDirectory, can skip it.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.196 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-113488")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.