GeoDirectory CVE-2026-119113

Requires an authenticated account with Subscriber-level access or above (PR:L), which is only reachable where the site permits user registration or otherwise grants untrusted users listing-submission ability. The attacker must inject into the listing description (post_content) a data-bs-content value on an element that AyeCode UI treats as [data-bs-toggle="popover-html"]; the payload only executes because that popover is initialized with { html: true, sanitize: false } and because wp_kses_post preserves data-* attributes while geodir_kses_safe_embed_attributes() only strips data-embed-url, data-src and data-embed. Execution additionally depends on another user (visitor or administrator) subsequently viewing the injected listing page. Limiting factors: the Subscriber authentication requirement, dependence on the AyeCode popover rendering path, and affected versions being 2.8.199 and earlier.

This is a moderate, authenticated stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reported by Wordfence and labeled 'this_month' priority by vuln.today - a real but non-emergency issue rather than a drop-everything threat. The signals are internally consistent: PR:L reflects the stated Subscriber-level requirement, AC:L reflects that no special timing or grooming is needed (the description details a deterministic sanitization gap, not a race), and S:C reflects that injected script executes in the browser of any other user who views the page. No EPSS score, KEV entry, or POC/exploit reference is present in the input, so exploitation probability cannot be quantified from the data provided; per the precision rules this is 'no public exploit identified at time of analysis.' The main factor keeping real-world risk below the CVSS number is the authentication prerequisite: an attacker needs at least a Subscriber account, which only matters where open user registration is enabled, and the C:L/I:L/A:N impact is limited to what XSS in a victim's session can achieve rather than direct server compromise. No data here is contradictory; the chief gap is the absence of EPSS/KEV/POC signals and an explicitly named fixed version.

On a GeoDirectory site that allows user registration, an attacker registers a Subscriber-level account and submits a directory listing whose description (post_content) contains an element with a crafted data-bs-content attribute carrying an HTML/script payload. Because wp_kses_post preserves data-* attributes and the plugin's embed-attribute filter does not neutralize data-bs-content, the payload survives save and the AyeCode UI popover renders it as HTML with sanitize:false, executing the script in the browser of any visitor or administrator who opens the listing page. No public exploit code is identified in the provided data.