Stored Cross-Site Scripting Vulnerability in GeoDirectory Plugin by WordPress
CVE-2026-113493
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-113493?
The GeoDirectory plugin for WordPress, prior to version 2.8.194, contains a vulnerability that fails to properly sanitize and escape certain attributes of its map shortcode. This oversight allows users with Contributor privileges and above to conduct Stored Cross-Site Scripting (XSS) attacks. The exploitation of this vulnerability can lead to the execution of malicious scripts in the browsers of users accessing the affected areas of the site, posing a significant security risk.
Affected Version(s)
GeoDirectory 0 < 2.8.194
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.