Live › vulnerability › CVE-2026-118635
The GeoDirectory WordPress plugin passes an unvalidated value to do_shortcode, so a request can trigger any registered shortcode. An unauthenticated attacker can run arbitrary shortcodes on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the GeoDirectory WordPress plugin at version 2.8.198 or earlier are exposed, and the request needs no login. The sources do not describe which shortcodes or site configurations make the impact worse, so the risk is unknown beyond running arbitrary shortcodes.
No product ranges from the sources yet.
2.8.198 are listed as affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
This page as .md · .json · in your agent: get_signal("CVE-2026-118635")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.