WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

Description

The plugin does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

Proof of Concept

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.194

References

CVE
CVE-2026-113493

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Jacek Sowiński
Submitter
Jacek Sowiński
Submitter twitter
thedzaku
Verified
Yes
WPVDB ID
a46bd6e9-4037-4213-b36d-e418a2ed41b7

Timeline

Publicly Published
2026-10-22 (about 2 days ago)
Added
2026-10-22 (about 1 day ago)
Last Updated
2026-10-22 (about 1 day ago)

Other

Published
Title
Published
2023-10-23
Title
Reusable Text Blocks <= 1.5.3 - Author+ Stored Cross-Site Scripting via Shortcode
Published
2022-02-07
Title
White Label MS < 2.2.9 - Reflected Cross-Site Scripting
Published
2026-06-30
Title
JetWidgets For Elementor < 1.0.22 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
Published
2019-06-27
Title
360 Product Rotation <= 1.4.7 - Reflected XSS
Published
2026-10-06
Title
Qode Music <= 2.1.8.2 - Unauthenticated Stored Cross-Site Scripting