Medium 6.8

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post...

CVE-2026-113487 First seen on SecPulse Oct 28, 15:00

Affected packages

Ecosystem	Package	Affected	Fixed
CVE	GeoDirectory	< 2.8.196	2.8.196

Original description The description as published by the source.

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.8; CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: Oct 28, 2026
First seen on SecPulse: Oct 28, 15:00
GHSA: GHSA-64wh-p786-vprv
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Geodirectory

Detection sources

NIST National Vulnerability Database03:17
GitHub Security Advisories (Global)03:33
CVE.org (CVE Program・cvelistV5)02:58