CVE-2026-113493

Description

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

Traduire en français

Produits concernés

• Unknown GeoDirectory

Références

• https://wpscan.com/vulnerability/a46bd6e9-4037-4213-b36d-e418a2ed41b7/

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories