CVE-2026-120671

The UsersWP plugin for WordPress (versions up to and including 1.2.80 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw resides in the 'badge' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or hig...

CVE-2026-113488

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

EUVD-2026-111726

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

CVE-2026-113488: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

PT-2026-127843

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...