medium6.8
CVE-2026-113493
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attrib…
Impact
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
Affected products
| Product | Affected versions |
|---|---|
| GeoDirectory WordPress Plugin | before 2.8.194 |
Versions were read from the advisory text. No structured product data has been published for this record yet.