CVE-2026-113487

MediumCVSS 6.8/10Last modified Oct 28, 2026

Description

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2026
Last modified
Oct 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1134886.8The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before CVE-2026-1134894.3The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing CVE-2026-113498.6The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise andCVE-2026-1134905.3The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup througCVE-2026-1134916.4The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saviCVE-2026-1134925.3The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of itsCVE-2026-1134936.8The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them wCVE-2026-1134942.7The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an iCVE-2026-1134955.0A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to bCVE-2026-1134965.0A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directCVE-2026-1134997.5The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes CVE-2026-11356.1A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activ
CVE-2026-113487: Medium severity, CVSS 6.8 | Vulnix