{"id":"CVE-2026-113493","kind":"vulnerability","aliases":["CVE-2026-113493"],"related":[],"title":"GeoDirectory WordPress plugin: map shortcode attributes allow stored cross-site scripting","description":"The GeoDirectory  WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not sanitise or escape some map shortcode attributes before writing them into a style attribute. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":null,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","no-map-shortcodes-in-content","plugin-version-2.8.194-or-later"],"how_to_check":"- Check the installed GeoDirectory version in the WordPress plugins list or with `wp plugin get geodirectory --field=version`\n- Search post content for map shortcodes used by GeoDirectory, written by Contributor-level accounts, and review their style-related attributes\n- unknown","fix":"- Update the GeoDirectory plugin to `2.8.194` or later\n- unknown","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to `2.8.194` or later\n- unknown","reach":"internet","title":"GeoDirectory WordPress plugin: map shortcode attributes allow stored cross-site scripting","impact":"medium","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not sanitise or escape some map shortcode attributes before writing them into a style attribute. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Stored script runs in visitors' and administrators' browsers on the site","analyst_note":"","how_to_check":"- Check the installed GeoDirectory version in the WordPress plugins list or with `wp plugin get geodirectory --field=version`\n- Search post content for map shortcodes used by GeoDirectory, written by Contributor-level accounts, and review their style-related attributes\n- unknown","needs_analyst":false,"not_affected_if":["plugin-version-2.8.194-or-later","no-contributor-accounts","no-map-shortcodes-in-content"],"who_is_affected":"Sites running GeoDirectory before `2.8.194` where Contributor-level or higher users can write content that includes GeoDirectory map shortcodes. Sites where only trusted editors write content, or sites without the plugin, are not exposed. The sources do not say whether default installs allow Contributor users to add these shortcodes.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3321,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113493':15A,18A '-2026':14A,17A '2.8.194':30B,75C 'affect':68B,120C 'allow':7A,94C 'anyon':64B 'attack':109C 'attribut':6A,39B,46B,86C,93C 'browser':62B 'content':121C 'context':114C 'contributor':51B,98C 'cross':10A,106C 'cross-sit':9A,105C 'cve':13A,16A 'escap':35B,80C 'execut':111C 'geodirectori':1A,19B,26B,71C 'higher':54B 'host':23B 'map':4A,37B,84C 'output':88C 'packag':20B 'page':69B 'perform':103C 'plugin':3A,28B,73C 'role':52B,99C 'run':59B 'sanitis':33B,78C 'script':12A,57B,108C 'self':22B 'self-host':21B 'shortcod':5A,38B,85C 'site':11A,107C 'store':8A,56B,104C 'style':45B,92C 'user':48B,95C,117C 'view':66B,118C 'within':90C 'wordpress':2A,24B,27B,72C 'write':41B","nicknames":[],"mitigations":[],"who_affected":"Sites running GeoDirectory before `2.8.194` where Contributor-level or higher users can write content that includes GeoDirectory map shortcodes. Sites where only trusted editors write content, or sites without the plugin, are not exposed. The sources do not say whether default installs allow Contributor users to add these shortcodes.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113493","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113493","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113493","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}