GeoDirectory EUVD-2026-109215

Requires an authenticated account with the Contributor role or higher on the target WordPress site, and the attacker must be able to place a GeoDirectory map shortcode whose style-related attributes are not sanitized/escaped before output within a style attribute. Exploitation only fires when another user (e.g., an administrator or site visitor) subsequently views the content holding the stored payload. Limiting factors: this is not remote-unauthenticated - a Contributor-level (or higher) account is mandatory, victim interaction (viewing the affected content) is required, and sites that do not grant untrusted users Contributor access or do not use the map shortcode are substantially less exposed.

This is a stored XSS (CWE-79) in the GeoDirectory WordPress plugin that a moderately-privileged user can leverage to execute script in the browser of anyone viewing the affected content. The signals point to a real but non-urgent, authentication-gated issue rather than a mass-exploitation emergency. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' - not 'act_now' or 'emergency'. A public PoC reference (WPScan) exists but is not verified as working exploit code, so POC availability must not be read as active exploitation. One important internal conflict: the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (score 6.8), which claims high privileges (PR:H), unchanged scope (S:U), and full C:H/I:H/A:H impact - yet the description states exploitation requires only the Contributor role ('and above'), which is a low-privilege account, and the nature of stored XSS (script running in a different user's browser) is normally a scope change with partial impact. The provided vector therefore appears inconsistent with the described mechanism (PR should likely be PR:L, scope likely S:C, and C/I/A likely Low) - verify the metrics with the vendor/WPScan. Net: treat as a medium-severity, authenticated stored XSS warranting patching this cycle, not a drop-everything priority.

An attacker who holds (or obtains) a Contributor-level account on a GeoDirectory site inserts a GeoDirectory map shortcode whose style-related attributes carry an unsanitized XSS payload. When an administrator or other user later views that post/listing, the injected script runs in their authenticated browser session, enabling session/cookie theft or admin-level actions. A WPScan PoC reference exists but is not verified as working exploit code; the network attack vector is offset by the need for an authenticated account and for a victim to view the content.