CVE-2026-113493: GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the Contributor role or any higher-privileged role can exploit it by creating affected content that uses the gd_map shortcode.
Who is exposed to the stored script?
The script executes in the browser context of any user who views the affected content, so exposure depends on who can access the page or post containing the malicious shortcode.
What configuration or input is involved?
The issue involves map shortcode attributes, specifically the width attribute, being output inside a style attribute without sufficient sanitisation and escaping.