Live › vulnerability › CVE-2026-113493
Go to dashboardThe GeoDirectory WordPress plugin before 2.8.194 does not sanitise or escape some map shortcode attributes before writing them into a style attribute. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running GeoDirectory before 2.8.194 where Contributor-level or higher users can write content that includes GeoDirectory map shortcodes. Sites where only trusted editors write content, or sites without the plugin, are not exposed. The sources do not say whether default installs allow Contributor users to add these shortcodes.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.194 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
This page as .md · .json · in your agent: get_signal("CVE-2026-113493")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.