Technical impact
The GeoDirectory WordPress plugin versions prior to 2.8.194 fail to sanitize and escape the width attribute of the gd_map shortcode before inserting it into a style attribute. Contributing users and higher can therefore persist malicious script data that is executed in the context of any visitor who loads the affected content, granting arbitrary code execution within the victim’s browser. This stored cross‑site scripting flaw can lead to session hijacking, credential theft, defacement, and other attacks that compromise the confidentiality, integrity, and availability of the site.
Affected Systems
The vulnerability affects the GeoDirectory plugin for WordPress, specifically all released versions older than 2.8.194. Any WordPress installation that has this plugin installed and allows contributors or higher roles to add or edit content is potentially impacted.
Risk and Exploitability
The CVSS score is 6.8. Exploitation requires a user with the Contributor role or higher to insert a malicious width attribute into the gd_map shortcode. An attacker who succeeds will cause every page displaying the content to execute the malicious script in the browser of any viewer. The EPSS score is 0.00208, indicating a very low but non‑zero probability of exploitation. Although the likelihood is small, the attack vector is straightforward and can lead to client‑side attacks with the privileges of the victim user.
