Detections
Analytics
CVE-2026-113493
medium
Description
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
References
https://wpscan.com/vulnerability/a46bd6e9-4037-4213-b36d-e418a2ed41b7/