CVE-2026-114429

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...

CVE-2026-113489

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

Obsidian-tc: Default Folder ACL Is Fail-open; .obsidian Plugin Secrets Are Readable By Default

Impact With a default configuration, an undefined "readPaths"/"writePaths" meant allow-all, the "strictReadDefault" flag was inert, and the ".obsidian"/".git"/".trash" control directories were denied only during enumeration — not on the direct request path. A caller could read...

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

WordPress GeoDirectory plugin < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification vulnerability

Unauthenticated Guest-Submitted Listing Modification vulnerability discovered by Vincent Suen GreenHat Security in WordPress Plugin GeoDirectory versions 2.8.194...

CVE-2026-114429

The WPVR WordPress plugin versions 8.5.49 through 9.0.2 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain tour hotspot content before storage and front-end output. This allows users with Contributor privileges or higher to ...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

WordPress GeoDirectory plugin < 2.8.194 - Admin+ RCE vulnerability

Admin+ RCE vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.194...

CVE-2026-113490

The GeoDirectory WordPress plugin versions before 2.8.194 is vulnerable to an information disclosure flaw. The application fails to perform status or ownership checks when rendering a listing's map-popup via a single-item REST route . This allows unauthenticated users to access the title , permal...

CVE-2026-113673

The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to properly escape administrator-defined text before it is written into a generated PHP file within the plugin's own folder. This flaw allows high-privilege users...

CVE-2026-113492

The GeoDirectory WordPress plugin (versions prior to 2.8.194 ) is vulnerable to unauthorized information disclosure. An unauthenticated attacker can access the content of non-public listings (such as draft , pending , and private entries) by providing specific listing IDs to one of the plugin's u...

WordPress GeoDirectory plugin < 2.8.194 - Unauthenticated Non-Public Listing Disclosure vulnerability

Unauthenticated Non-Public Listing Disclosure vulnerability discovered by Jacek Sowiński in WordPress Plugin GeoDirectory versions 2.8.194...

CVE-2026-113490 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public draft, pending, private and...

CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

CVE-2026-113493

The GeoDirectory WordPress plugin versions prior to 2.8.194 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape certain map shortcode attributes (specifically the width attribute in the gd_map shortcode) before they are outputted within a sty...

CVE-2026-97352

The News Kit Addons For Elementor WordPress plugin (versions prior to 1.4.9 ) is vulnerable to an authorization bypass. The software fails to perform a capability check on one of its AJAX actions, specifically involving nekit_install_importer. This flaw allows authenticated users with subscriber-...