CVE-2026-113487 in GeoDirectory Plugin
Summary
by MITRE • 10/28/2026
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in GeoDirectory versions prior to 2.8.196 represents a critical security flaw within the WordPress plugin ecosystem, specifically targeting the handling of user-generated content associated with post badges. The core technical deficiency lies in the insufficient sanitization and escaping mechanisms applied to the click-through link value when it is rendered within an anchor element on public-facing listings. In standard web application architecture, data originating from users must be rigorously validated against expected formats and encoded appropriately before being inserted into HTML contexts to prevent malicious interpretation by the browser. However, in this specific implementation, the plugin fails to apply necessary output encoding or validation checks for the href attribute of anchor tags associated with badge links. This oversight creates a direct pathway for attackers to inject executable JavaScript code directly into the database through legitimate administrative interfaces that allow content creation or modification.
This flaw is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). More specifically, because the malicious payload persists in the application's data store and is served to other users upon subsequent requests, it falls squarely into the category of Stored XSS. The attack vector requires a relatively low privilege level, as any user with Contributor role or higher can exploit this vulnerability. This accessibility makes the threat particularly severe within multi-author WordPress environments where content moderation workflows are active. An attacker possessing these credentials can craft a malicious badge link containing JavaScript payloads that execute in the context of the victim's session when viewed.
The operational impact is significant, primarily affecting administrators and other high-privileged users who review moderated content or view listings featuring badges crafted by lower-privilege contributors. When an administrator visits a listing to approve or moderate it, their browser will parse the injected script within the anchor tag. Because this execution occurs in the context of the admin's authenticated session on the WordPress site, the attacker can perform actions such as stealing administrative cookies, capturing session tokens, performing unauthorized state-changing requests like creating new users or modifying settings, and defacing the website interface. The persistence of the payload means that every administrator who views the compromised listing is potentially exposed to exploitation without their knowledge, leading to a widespread compromise if multiple admins review content containing the malicious badge link.
From an adversary perspective, this vulnerability aligns with ATT&CK technique T1059.007, which covers JavaScript execution within web browsers, and can facilitate subsequent techniques such as Credential Access via Browser Cookie Harvesting (T1539) or Defense Evasion through persistence mechanisms if the attacker gains sufficient control to modify site configurations. The lack of proper output encoding allows the malicious script to bypass standard browser security policies that rely on context-aware escaping, thereby enabling full client-side exploitation capabilities limited only by the Same-Origin Policy and the privileges of the viewing user.
To mitigate this vulnerability, immediate action is required to update the GeoDirectory plugin to version 2.8.196 or later, where these sanitization issues have been addressed. For organizations unable to patch immediately due to compatibility concerns with other plugins, a temporary workaround involves restricting the Contributor role and above from creating or editing badge links until an upgrade can be performed. Additionally, implementing a Content Security Policy (CSP) header that restricts script execution sources can provide a layer of defense-in-depth by preventing inline scripts from executing even if they are injected into the DOM. Regular security audits focusing on input validation and output encoding practices for all user-controllable fields in WordPress plugins are essential to prevent similar vulnerabilities in future updates or other third-party extensions.