{"id":"CVE-2026-119113","kind":"vulnerability","aliases":["CVE-2026-119113"],"related":[],"title":"GeoDirectory WordPress plugin: stored XSS via listing descriptions","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle=\"popover-html\"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"Versions up to and including 2.8.199 of the GeoDirectory WordPress plugin let a logged-in Subscriber inject a popover attribute into a listing description that is rendered as HTML. Visitors who open the injected page run the attacker's JavaScript in their browser.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["no-subscriber-registration","plugin-not-installed","version-above-2.8.199"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen against `2.8.199`\n- Look for listing content containing `data-bs-toggle=\"popover-html\"` with a `data-bs-content` attribute","fix":"- Move the GeoDirectory plugin to a version later than `2.8.199`; the fixed version is not stated in the sources","status":"open","published_at":"2026-10-30T18:17:25+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:57:05+00:00","updated_at":"2026-10-30T18:57:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T18:57:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move the GeoDirectory plugin to a version later than `2.8.199`; the fixed version is not stated in the sources","reach":"internet","title":"GeoDirectory WordPress plugin: stored XSS via listing descriptions","impact":"medium","summary":"Versions up to and including 2.8.199 of the GeoDirectory WordPress plugin let a logged-in Subscriber inject a popover attribute into a listing description that is rendered as HTML. Visitors who open the injected page run the attacker's JavaScript in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen against `2.8.199`\n- Look for listing content containing `data-bs-toggle=\"popover-html\"` with a `data-bs-content` attribute","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-above-2.8.199","no-subscriber-registration"],"who_is_affected":"Sites running the GeoDirectory plugin at version 2.8.199 or earlier where subscribers or other users with low-level accounts can submit listing descriptions. Sites without the plugin, or where only trusted editors can write listings, have lower exposure. The exploit depends on the AyeCode popover rendering path, which is part of the plugin.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4345,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119113':11A,14A '-2026':10A,13A '2.8.199':26B,98C 'access':194C,210C 'arbitrari':199C 'attack':59B,167C,189C 'attacker-control':166C 'attribut':41B,114C,137C 'authent':188C 'ayecod':145C 'bodi':177C 'browser':64B 'bs':152C,171C 'bundl':109C 'busi':68C 'classifi':72C 'combin':142C 'content':91C,172C 'control':168C 'core':131C 'cross':83C 'cross-sit':82C 'cve':9A,12A 'data':119C,123C,127C,136C,151C,170C 'data-bs-cont':169C 'data-bs-toggl':150C 'data-emb':126C 'data-embed-url':118C 'data-src':122C 'descript':8A,45B,89C 'directori':69C,74C 'due':101C 'element':157C 'emb':113C,120C,128C 'everi':149C 'execut':206C 'fals':162C 'geodir':110C 'geodirectori':1A,15B,29B,66C 'helper':115C 'host':19B 'html':50B,140C,156C,159C,179C 'includ':25B,97C 'initi':148C 'inject':38B,55B,198C,212C 'input':104C 'insert':164C 'insuffici':103C 'javascript':61B 'kses':111C,133C 'let':32B 'level':193C 'librari':147C 'list':7A,44B,73C,88C 'log':35B 'logged-in':34B 'make':184C 'neutralis':117C 'open':53B 'packag':16B 'page':56B,203C,213C 'permit':135C 'plugin':3A,31B,70C,75C 'popov':40B,155C,176C 'popover-html':154C 'possibl':186C 'post':90C,134C 'render':48B,181C 'run':57B 'safe':112C 'sanit':105C,161C 'save':107C 'script':85C,201C 'self':18B 'self-host':17B 'site':84C 'src':124C 'standard':139C 'store':4A,81C 'subscrib':37B,192C 'subscriber-level':191C 'tag':141C 'time':182C 'toggl':153C 'true':160C 'ui':146C 'url':121C 'user':209C 'valu':173C 'version':21B,93C 'via':6A,86C 'visitor':51B 'vulner':79C 'web':200C 'whenev':207C 'wordpress':2A,20B,30B,77C,130C 'wp':67C,132C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory plugin at version 2.8.199 or earlier where subscribers or other users with low-level accounts can submit listing descriptions. Sites without the plugin, or where only trusted editors can write listings, have lower exposure. The exploit depends on the AyeCode popover rendering path, which is part of the plugin.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119113","severity":null,"published_at":"2026-10-30T18:17:25+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}