Stored Cross-Site Scripting in GeoDirectory Plugin for WordPress
CVE-2026-113487
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-113487?
The GeoDirectory WordPress plugin prior to version 2.8.196 contains a vulnerability that allows a post badge click-through link value to be improperly sanitized or escaped. This flaw permits users with Contributor roles and higher to exploit stored cross-site scripting attacks, targeting higher-privileged users, including administrators reviewing moderated content. Proper sanitation measures are essential to prevent the execution of malicious scripts and protect user data from unauthorized access.
Affected Version(s)
GeoDirectory 0 < 2.8.196
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.