CVE-2026-113489: medium-severity vulnerability in GeoDirectory
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · GeoDirectorypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GeoDirectory
In the same product, most dangerous first.
CVE-2023-0278HIGHGeoDirectory < 2.2.24 - Admin+ SQLiEPSS 0.8%CVE-2026-113673HIGHGeoDirectory < 2.8.194 - Admin+ RCE via DB Text ExportEPSS 0.6%CVE-2022-4775MEDIUMGeoDirectory < 2.2.22 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2026-16988HIGHGeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST EndpointEPSS 0.4%CVE-2026-16968MEDIUMGeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_usersEPSS 0.4%CVE-2026-113488MEDIUMGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' AttributeEPSS 0.3%