CVE-2026-113491

The GeoDirectory WordPress plugin (versions before 2.8.194 ) is vulnerable to a Path Traversal vulnerability (CWE-22 ) due to insufficient validation of user-supplied image URLs when saving front-end listings. This flaw allows users with Subscriber-level access or higher to read files from outsid...

CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

EUVD-2018-21148

Malware in sbrugna...