CVE-2026-113673
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
Risk Assessment
Remote code execution triggerable by an unauthenticated visitor poses a critical risk of server takeover and full site compromise.
Recommendation
Update the GeoDirectory plugin to version 2.8.194 or later, which includes the fix for escaping administrator text before writing to a PHP file.
Other vulnerabilities in GeoDirectory
See all- CVE-2026-66604High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
- CVE-2026-84813Critical
Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-39512Critical
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
- CVE-2026-116752Medium
The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.
- CVE-2026-113494Low
The GeoDirectory plugin for WordPress before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes. This allows users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
- CVE-2026-113488Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
- CVE-2026-113487Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
- CVE-2026-113674Low
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. This allows unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
- CVE-2026-113493Medium
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
- CVE-2026-113492Medium
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers. This allows unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Original NVD description (English source)
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS