GeoDirectory CVE-2026-113487

Requires an authenticated account with the Contributor role or higher on the target WordPress site - so exploitation is limited to deployments that provision such accounts to untrusted or semi-trusted users (community submissions, multi-author directories). The attacker must set the post badge click-through link value on a listing, and the payload only fires when a higher-privileged user (the description names an administrator reviewing moderated content) actually views the affected listing, i.e. user interaction by the victim is required (UI:R). Sites that do not grant Contributor-level access to untrusted parties, or that do not have admins manually review listings, are materially less exposed. The complete fix is updating to GeoDirectory 2.8.196; no vendor-provided mitigation other than updating is stated in the available sources.

This is a moderate, authenticated stored XSS in the GeoDirectory WordPress plugin, and the signals are internally consistent in pointing to a non-emergency but patch-worthy issue. Exploitation status is 'no public exploit identified at time of analysis' - the only references are the WPScan advisory and the NVD entry, neither of which is working exploit code, and the vulnerability is NOT in CISA KEV. EPSS is low (0.17%, 6th percentile), consistent with the absence of public exploitation and with the fact that the attack requires an authenticated foothold plus victim interaction. The supplied CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U, 6.8) and the description are partly in tension: the description says a Contributor-role user (a low-privilege authenticated account) can inject the payload, which argues for PR:L rather than the PR:H shown in the vector - verify privilege level with the advisory. The vector also marks Scope Unchanged (S:U), but because the injected script executes in the browser/session of a higher-privileged victim (an administrator moderating content), a scope-change (S:C) reading is defensible. The vuln.today decision label is 'this_month', which aligns with the low EPSS and absence of KEV/PoC: schedule the update in a normal patch cycle rather than treating it as an emergency. Net: a real priority for sites that allow untrusted Contributor accounts, but not a mass-exploitation threat.

A site operator grants Contributor accounts (e.g. to community members submitting business listings). A malicious Contributor creates or edits a listing and sets a post-badge click-through link value containing a crafted payload that is not sanitised/escaped when rendered inside an anchor element. When an administrator later opens that listing to moderate the pending content, the stored script executes in the administrator's authenticated session. No public exploit code is identified at time of analysis.