WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute

Description

The plugin does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

Proof of Concept

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.196

References

CVE
CVE-2026-113487

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
0117ed44-672d-4308-9fa0-0eb04fccd255

Timeline

Publicly Published
2026-10-26 (about 2 days ago)
Added
2026-10-26 (about 1 day ago)
Last Updated
2026-10-26 (about 1 day ago)

Other

Published
Title
Published
2024-09-12
Title
Avada | Website Builder For WordPress & eCommerce < 3.11.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
Published
2016-05-26
Title
Polldaddy Polls & Ratings <= 2.0.31 - Shortcode Stored Cross-Site Scripting (XSS)
Published
2024-03-07
Title
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor < 3.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block
Published
2024-04-15
Title
What's New Generator <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-11-20
Title
Branda – White Label & Branding, Custom Login Page Customizer < 3.4.22 - Reflected Cross-Site Scripting