GeoDirectory CVE-2026-113488

Requires the GeoDirectory plugin (version before 2.8.196) installed, plus an authenticated account holding the Contributor role or higher that can use the post badge shortcode and control its attribute value. Exploitation is not fully automatic: a victim (typically an administrator) must view and click the rendered badge for the stored payload in the inline event handler to fire (UI:R). Limiting factors: the site must permit Contributor-level (or higher) accounts to untrusted users, the attacker must be authenticated, and victim click interaction is required - so sites that do not expose Contributor accounts to outsiders face substantially lower real risk.

This is a moderate, not emergency, priority. The vuln.today decision label is 'this_month', EPSS is low at 0.17% (6th percentile), and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis' (the only reference is the WPScan advisory, not verified working exploit code). The supplied CVSS of 6.8 uses PR:H, but the description states the attacker only needs the Contributor role 'and above'; Contributor is a low-privilege WordPress role, so PR:H appears overstated and PR:L is more accurate - verify, because this materially changes the realism of exploitation (self-registration/contributor accounts are common on content sites). The supplied impact set C:H/I:H/A:H is also aggressive for a stored XSS; real impact depends on compromising an administrator session. Signals are internally consistent on 'real but low-urgency': network vector and low complexity raise theoretical reach, but PR (authenticated) plus UI:R (victim must click the badge) plus low EPSS and no KEV point to a targeted, not mass, threat. Net: patch on a normal cycle, prioritize sites that allow untrusted Contributor-level accounts.

An attacker obtains or registers a Contributor-level account on a GeoDirectory site and submits a post badge shortcode whose attribute carries a JavaScript payload that lands unescaped inside an inline event handler. When an administrator or other user later views the listing and clicks the badge, the stored script executes in their browser, potentially hijacking the admin session. No verified public exploit code is identified; only the WPScan advisory reference exists.