Live › vulnerability › CVE-2026-119113
Versions up to and including 2.8.199 of the GeoDirectory WordPress plugin let a logged-in Subscriber inject a popover attribute into a listing description that is rendered as HTML. Visitors who open the injected page run the attacker's JavaScript in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin at version 2.8.199 or earlier where subscribers or other users with low-level accounts can submit listing descriptions. Sites without the plugin, or where only trusted editors can write listings, have lower exposure. The exploit depends on the AyeCode popover rendering path, which is part of the plugin.
No product ranges from the sources yet.
2.8.199data-bs-toggle="popover-html" with a data-bs-content attribute2.8.199; the fixed version is not stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-119113")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.