CVE-2026-113493 in GeoDirectory Plugin
Summary
by MITRE • 10/24/2026
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in GeoDirectory versions prior to 2.8.194 represents a significant security flaw within the WordPress plugin ecosystem, specifically targeting how map shortcode attributes are processed and rendered. The core issue stems from an insufficient sanitization and escaping mechanism applied to specific input fields associated with map shortcodes. When these inputs contain malicious script payloads rather than valid data structures, the application fails to neutralize them before embedding them into HTML style attributes during page rendering. This failure in input validation allows attackers to inject executable JavaScript code directly into the content structure of a webpage managed by the plugin.
From an operational perspective, this flaw enables Stored Cross-Site Scripting attacks that are particularly dangerous due to their persistence and broad impact potential. Unlike reflected XSS where the payload is delivered via a link, stored vulnerabilities reside on the target server's database or file system. In this case, any user possessing at least Contributor-level privileges can exploit this weakness by crafting malicious shortcodes containing script tags within map attributes. Once saved, these payloads become part of the site content and are served to every visitor who views the affected page. This means that even low-privilege users can compromise the security posture for all other users, including administrators, without needing direct access to administrative panels or high-level capabilities beyond basic content creation.
The technical execution relies on the browser's interpretation of HTML style attributes as potential vectors for script injection if proper context switching is not enforced by the application code. By failing to escape special characters such as quotes and angle brackets within these specific shortcode parameters, GeoDirectory allows the injected JavaScript to break out of its intended data context and execute in the global scope of the victim's browser session. This execution occurs under the security context of the website domain, granting the attacker access to sensitive cookies, session tokens, local storage data, or the ability to perform actions on behalf of the authenticated user viewing the content.
This vulnerability aligns with Common Weakness Enumeration category CWE-79, which classifies improper neutralization of input during web page generation as a Cross-site Scripting weakness. Furthermore, from an adversary tactics perspective, it maps directly to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within the browser environment. The attack vector leverages social engineering or privilege escalation indirectly by exploiting the trust users place in content authored by contributors, thereby facilitating credential theft, session hijacking, and potential defacement of the affected WordPress site.
Mitigation strategies must prioritize immediate software updates as the primary defense mechanism. Administrators running GeoDirectory versions earlier than 2.8.194 should upgrade to the latest patched version where input sanitization routines have been hardened to properly escape all user-supplied data before it is rendered in HTML attributes. In addition to patching, organizations should enforce strict role-based access control policies within WordPress environments. Limiting the ability to publish content with shortcodes to trusted administrators or editors can reduce the attack surface for stored XSS incidents. Furthermore, implementing a Web Application Firewall capable of detecting and blocking malicious script injections in HTTP requests provides an additional layer of defense against exploitation attempts while patch management processes are completed.