CVE-2026-113673None▾ SunlitThe GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
GeoDirectory < 2.8.194Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113493NoneGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-113491NoneGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-113489NoneGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113490NoneGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
CVE-2026-113674NoneGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113492NoneGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action