{"schema_version":"2","view":"grouped","data":[{"id":56314,"cve_ids":["CVE-2026-113673"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.","evidence":"cve:CVE-2026-113673","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113673","aliases":["CVE-2026-113673"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.626Z","provider":"cve","references":["https://wpscan.com/vulnerability/7ef117ed-1fd6-48e6-b242-87a7b65d3477/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:41.949048Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.626Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.845Z"}}},"related_cves":[{"value":"CVE-2026-113673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0af3a149-4b67-4beb-ab9c-4769136bd9b0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113673","advisory_id":"0af3a149-4b67-4beb-ab9c-4769136bd9b0","event_types":["advisory"],"published_at":"2026-10-25T16:12:45.654043+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.845+00:00","detail_url":"/advisories/advisory%3A0af3a149-4b67-4beb-ab9c-4769136bd9b0","group":{"id":"advisory:0af3a149-4b67-4beb-ab9c-4769136bd9b0","revision":1,"primary_event_id":55837,"change":"published","superseded_by":[],"changed":{"id":55837,"cve_ids":["CVE-2026-113673"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.","evidence":"cve:CVE-2026-113673","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113673","aliases":["CVE-2026-113673"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.626Z","provider":"cve","references":["https://wpscan.com/vulnerability/7ef117ed-1fd6-48e6-b242-87a7b65d3477/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:41.949048Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.626Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.845Z"}}},"related_cves":[{"value":"CVE-2026-113673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0af3a149-4b67-4beb-ab9c-4769136bd9b0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113673","advisory_id":"0af3a149-4b67-4beb-ab9c-4769136bd9b0","event_types":["advisory"],"published_at":"2026-10-25T16:12:45.654043+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.845+00:00","detail_url":"/events/55837"},"members":[{"id":55837,"cve_ids":["CVE-2026-113673"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.","evidence":"cve:CVE-2026-113673","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113673","aliases":["CVE-2026-113673"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.626Z","provider":"cve","references":["https://wpscan.com/vulnerability/7ef117ed-1fd6-48e6-b242-87a7b65d3477/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:41.949048Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.626Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.845Z"}}},"related_cves":[{"value":"CVE-2026-113673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0af3a149-4b67-4beb-ab9c-4769136bd9b0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113673","advisory_id":"0af3a149-4b67-4beb-ab9c-4769136bd9b0","event_types":["advisory"],"published_at":"2026-10-25T16:12:45.654043+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.845+00:00","detail_url":"/events/55837"}]}},{"id":56313,"cve_ids":["CVE-2026-113674"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","evidence":"cve:CVE-2026-113674","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113674","aliases":["CVE-2026-113674"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.488Z","provider":"cve","references":["https://wpscan.com/vulnerability/23e66ca1-50eb-4ac1-9f5f-f830235c5af0/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:28.756098Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.488Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:20.014Z"}}},"related_cves":[{"value":"CVE-2026-113674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:226f6333-11cd-473c-8547-467a290f5df0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113674","advisory_id":"226f6333-11cd-473c-8547-467a290f5df0","event_types":["advisory"],"published_at":"2026-10-25T16:12:44.762111+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:20.014+00:00","detail_url":"/advisories/advisory%3A226f6333-11cd-473c-8547-467a290f5df0","group":{"id":"advisory:226f6333-11cd-473c-8547-467a290f5df0","revision":1,"primary_event_id":55836,"change":"published","superseded_by":[],"changed":{"id":55836,"cve_ids":["CVE-2026-113674"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","evidence":"cve:CVE-2026-113674","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113674","aliases":["CVE-2026-113674"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.488Z","provider":"cve","references":["https://wpscan.com/vulnerability/23e66ca1-50eb-4ac1-9f5f-f830235c5af0/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:28.756098Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.488Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:20.014Z"}}},"related_cves":[{"value":"CVE-2026-113674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:226f6333-11cd-473c-8547-467a290f5df0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113674","advisory_id":"226f6333-11cd-473c-8547-467a290f5df0","event_types":["advisory"],"published_at":"2026-10-25T16:12:44.762111+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:20.014+00:00","detail_url":"/events/55836"},"members":[{"id":55836,"cve_ids":["CVE-2026-113674"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.","evidence":"cve:CVE-2026-113674","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113674","aliases":["CVE-2026-113674"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.488Z","provider":"cve","references":["https://wpscan.com/vulnerability/23e66ca1-50eb-4ac1-9f5f-f830235c5af0/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:28.756098Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.488Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:20.014Z"}}},"related_cves":[{"value":"CVE-2026-113674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:226f6333-11cd-473c-8547-467a290f5df0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113674","advisory_id":"226f6333-11cd-473c-8547-467a290f5df0","event_types":["advisory"],"published_at":"2026-10-25T16:12:44.762111+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:20.014+00:00","detail_url":"/events/55836"}]}},{"id":56312,"cve_ids":["CVE-2026-113493"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.","evidence":"cve:CVE-2026-113493","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113493","aliases":["CVE-2026-113493"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.764Z","provider":"cve","references":["https://wpscan.com/vulnerability/a46bd6e9-4037-4213-b36d-e418a2ed41b7/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:51.737991Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.764Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.669Z"}}},"related_cves":[{"value":"CVE-2026-113493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7fc77380-7ff1-48d1-951c-82a06be0ce6a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113493","advisory_id":"7fc77380-7ff1-48d1-951c-82a06be0ce6a","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.906352+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.669+00:00","detail_url":"/advisories/advisory%3A7fc77380-7ff1-48d1-951c-82a06be0ce6a","group":{"id":"advisory:7fc77380-7ff1-48d1-951c-82a06be0ce6a","revision":1,"primary_event_id":55835,"change":"published","superseded_by":[],"changed":{"id":55835,"cve_ids":["CVE-2026-113493"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.","evidence":"cve:CVE-2026-113493","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113493","aliases":["CVE-2026-113493"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.764Z","provider":"cve","references":["https://wpscan.com/vulnerability/a46bd6e9-4037-4213-b36d-e418a2ed41b7/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:51.737991Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.764Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.669Z"}}},"related_cves":[{"value":"CVE-2026-113493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7fc77380-7ff1-48d1-951c-82a06be0ce6a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113493","advisory_id":"7fc77380-7ff1-48d1-951c-82a06be0ce6a","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.906352+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.669+00:00","detail_url":"/events/55835"},"members":[{"id":55835,"cve_ids":["CVE-2026-113493"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.","evidence":"cve:CVE-2026-113493","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113493","aliases":["CVE-2026-113493"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.764Z","provider":"cve","references":["https://wpscan.com/vulnerability/a46bd6e9-4037-4213-b36d-e418a2ed41b7/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T14:32:51.737991Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.764Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.669Z"}}},"related_cves":[{"value":"CVE-2026-113493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7fc77380-7ff1-48d1-951c-82a06be0ce6a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113493","advisory_id":"7fc77380-7ff1-48d1-951c-82a06be0ce6a","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.906352+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.669+00:00","detail_url":"/events/55835"}]}},{"id":56311,"cve_ids":["CVE-2026-113492"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.","evidence":"cve:CVE-2026-113492","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113492","aliases":["CVE-2026-113492"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.914Z","provider":"cve","references":["https://wpscan.com/vulnerability/5a1c17a0-c513-4f64-91c7-09c0f1878c71/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113492","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:01.258956Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.914Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.499Z"}}},"related_cves":[{"value":"CVE-2026-113492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b02498f7-aed6-41d1-a46d-40014392fffc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113492","advisory_id":"b02498f7-aed6-41d1-a46d-40014392fffc","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.257147+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.499+00:00","detail_url":"/advisories/advisory%3Ab02498f7-aed6-41d1-a46d-40014392fffc","group":{"id":"advisory:b02498f7-aed6-41d1-a46d-40014392fffc","revision":1,"primary_event_id":55834,"change":"published","superseded_by":[],"changed":{"id":55834,"cve_ids":["CVE-2026-113492"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.","evidence":"cve:CVE-2026-113492","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113492","aliases":["CVE-2026-113492"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.914Z","provider":"cve","references":["https://wpscan.com/vulnerability/5a1c17a0-c513-4f64-91c7-09c0f1878c71/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113492","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:01.258956Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.914Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.499Z"}}},"related_cves":[{"value":"CVE-2026-113492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b02498f7-aed6-41d1-a46d-40014392fffc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113492","advisory_id":"b02498f7-aed6-41d1-a46d-40014392fffc","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.257147+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.499+00:00","detail_url":"/events/55834"},"members":[{"id":55834,"cve_ids":["CVE-2026-113492"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.","evidence":"cve:CVE-2026-113492","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113492","aliases":["CVE-2026-113492"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:53.914Z","provider":"cve","references":["https://wpscan.com/vulnerability/5a1c17a0-c513-4f64-91c7-09c0f1878c71/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113492","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:01.258956Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:53.914Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.499Z"}}},"related_cves":[{"value":"CVE-2026-113492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b02498f7-aed6-41d1-a46d-40014392fffc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113492","advisory_id":"b02498f7-aed6-41d1-a46d-40014392fffc","event_types":["advisory"],"published_at":"2026-10-25T16:12:43.257147+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.499+00:00","detail_url":"/events/55834"}]}},{"id":56310,"cve_ids":["CVE-2026-113491"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.","evidence":"cve:CVE-2026-113491","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113491","aliases":["CVE-2026-113491"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.057Z","provider":"cve","references":["https://wpscan.com/vulnerability/ba2114a5-01e3-40e7-a7f6-673674b6501d/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113491","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:16.370656Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.057Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.319Z"}}},"related_cves":[{"value":"CVE-2026-113491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44713191-6790-4e4b-b2df-083471fad487","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113491","advisory_id":"44713191-6790-4e4b-b2df-083471fad487","event_types":["advisory"],"published_at":"2026-10-25T16:12:42.580777+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.319+00:00","detail_url":"/advisories/advisory%3A44713191-6790-4e4b-b2df-083471fad487","group":{"id":"advisory:44713191-6790-4e4b-b2df-083471fad487","revision":1,"primary_event_id":55833,"change":"published","superseded_by":[],"changed":{"id":55833,"cve_ids":["CVE-2026-113491"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.","evidence":"cve:CVE-2026-113491","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113491","aliases":["CVE-2026-113491"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.057Z","provider":"cve","references":["https://wpscan.com/vulnerability/ba2114a5-01e3-40e7-a7f6-673674b6501d/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113491","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:16.370656Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.057Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.319Z"}}},"related_cves":[{"value":"CVE-2026-113491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44713191-6790-4e4b-b2df-083471fad487","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113491","advisory_id":"44713191-6790-4e4b-b2df-083471fad487","event_types":["advisory"],"published_at":"2026-10-25T16:12:42.580777+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.319+00:00","detail_url":"/events/55833"},"members":[{"id":55833,"cve_ids":["CVE-2026-113491"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.","evidence":"cve:CVE-2026-113491","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113491","aliases":["CVE-2026-113491"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.057Z","provider":"cve","references":["https://wpscan.com/vulnerability/ba2114a5-01e3-40e7-a7f6-673674b6501d/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113491","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:16.370656Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.057Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.319Z"}}},"related_cves":[{"value":"CVE-2026-113491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44713191-6790-4e4b-b2df-083471fad487","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113491","advisory_id":"44713191-6790-4e4b-b2df-083471fad487","event_types":["advisory"],"published_at":"2026-10-25T16:12:42.580777+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.319+00:00","detail_url":"/events/55833"}]}},{"id":56309,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/advisories/advisory%3A89228764-d18e-4ee5-9665-88436996912b","group":{"id":"advisory:89228764-d18e-4ee5-9665-88436996912b","revision":1,"primary_event_id":55832,"change":"published","superseded_by":[],"changed":{"id":55832,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/events/55832"},"members":[{"id":55832,"cve_ids":["CVE-2026-113490"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.","evidence":"cve:CVE-2026-113490","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113490","aliases":["CVE-2026-113490"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.215Z","provider":"cve","references":["https://wpscan.com/vulnerability/2901f8f3-0b35-4565-b248-6c0dfc5de894/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:27.928810Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.215Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:19.138Z"}}},"related_cves":[{"value":"CVE-2026-113490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:89228764-d18e-4ee5-9665-88436996912b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113490","advisory_id":"89228764-d18e-4ee5-9665-88436996912b","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.845458+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:19.138+00:00","detail_url":"/events/55832"}]}},{"id":56308,"cve_ids":["CVE-2026-113489"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.","evidence":"cve:CVE-2026-113489","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113489","aliases":["CVE-2026-113489"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.372Z","provider":"cve","references":["https://wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113489","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:37.588720Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.372Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:18.964Z"}}},"related_cves":[{"value":"CVE-2026-113489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2fa2a-b223-4a45-9037-59ee58e2949a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113489","advisory_id":"a4b2fa2a-b223-4a45-9037-59ee58e2949a","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.193324+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:18.964+00:00","detail_url":"/advisories/advisory%3Aa4b2fa2a-b223-4a45-9037-59ee58e2949a","group":{"id":"advisory:a4b2fa2a-b223-4a45-9037-59ee58e2949a","revision":1,"primary_event_id":55831,"change":"published","superseded_by":[],"changed":{"id":55831,"cve_ids":["CVE-2026-113489"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.","evidence":"cve:CVE-2026-113489","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113489","aliases":["CVE-2026-113489"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.372Z","provider":"cve","references":["https://wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113489","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:37.588720Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.372Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:18.964Z"}}},"related_cves":[{"value":"CVE-2026-113489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2fa2a-b223-4a45-9037-59ee58e2949a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113489","advisory_id":"a4b2fa2a-b223-4a45-9037-59ee58e2949a","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.193324+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:18.964+00:00","detail_url":"/events/55831"},"members":[{"id":55831,"cve_ids":["CVE-2026-113489"],"payload":{"kind":"advisory","title":"GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR","summary":"The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.","evidence":"cve:CVE-2026-113489","products":[{"name":{"value":"GeoDirectory","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-113489","aliases":["CVE-2026-113489"],"metrics":[],"affected":[{"vendor":"Unknown","product":"GeoDirectory","versions":[{"status":"affected","version":"0","lessThan":"2.8.194","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T14:36:54.372Z","provider":"cve","references":["https://wpscan.com/vulnerability/2f539d43-6f95-494f-b399-21697145591e/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-113489","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:33:37.588720Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:36:54.372Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-10-24T06:00:18.964Z"}}},"related_cves":[{"value":"CVE-2026-113489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4b2fa2a-b223-4a45-9037-59ee58e2949a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113489","advisory_id":"a4b2fa2a-b223-4a45-9037-59ee58e2949a","event_types":["advisory"],"published_at":"2026-10-25T16:12:41.193324+00:00","technologies":["core-cve","geodirectory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:00:18.964+00:00","detail_url":"/events/55831"}]}}],"next_after":56314,"next_before":56308}