Medium 6.8

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode...

CVE-2026-113488 First seen on SecPulse Oct 28, 15:00

Affected packages

Ecosystem	Package	Affected	Fixed
CVE	GeoDirectory	< 2.8.196	2.8.196

Original description The description as published by the source.

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.8; CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Published: Oct 28, 2026
First seen on SecPulse: Oct 28, 15:00
GHSA: GHSA-8x4j-963r-3gx3
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

JavaScript

Web Frameworks

WordPress

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Geodirectory

Detection sources

NIST National Vulnerability Database03:17
GitHub Security Advisories (Global)03:33
CVE.org (CVE Program・cvelistV5)02:58