Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 41 high, 60 medium, 26 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	3.7	CVE-2026-113674	The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113674The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets logged-out users edit listings they do not own. The advisory rates the issue low severity with a CVSS score of 3.7 and says the fix is in version 2.8.194. Site owners should update the plugin to 2.8.194 or later. Technical summary The flaw is a broken access control issue (CWE-284) in which the plugin does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. The advisory says the issue allows unauthorized edits, and the snippet is truncated so the full impact is not shown. The vulnerable versions are described as those before 2.8.194, and the fixed version is 2.8.194. The CVSS score is 3.7 (low) as stated. No workaround, exploitation status in the wild, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/23e66ca1-50eb-…c1-9f5f-f830235c5af0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.2	CVE-2026-113673	The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113673The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets an administrator-defined text value be written unsafely into a generated PHP file. The advisory rates it high severity with a CVSS score of 7.2 and says the fix is to update to version 2.8.194. Technical summary The weakness is classified as CWE-94 (code injection) and as remote code execution, and the advisory states that administrator-defined text is not properly escaped before it is written into a generated PHP file in the plugin's own folder. The advisory text is truncated, so the attack vector and preconditions beyond the administrator-defined input are not fully stated. Affected versions are stated as before 2.8.194, and the fixed version is 2.8.194. Workarounds are not stated. Detection guidance is not stated. The CVSS vector string is not stated; only the score of 7.2 (high) is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7ef117ed-1fd6-…e6-b242-87a7b65d3477 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-113493	The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113493The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, contains a cross-site scripting flaw in its map shortcode handling. The advisory rates it medium severity (CVSS 6.8, as listed) and the fix is to update the plugin to 2.8.194 or later. Technical summary The flaw is cross-site scripting (CWE-79) caused by the plugin not sanitising or escaping some map shortcode attributes before outputting them inside a style attribute. The advisory's text is truncated, so the attack vector and required privileges are not fully stated. The fixed version is 2.8.194, and the advisory lists the plugin as before that version. Workarounds are not stated. Detection guidance is not stated. The listed CVSS score of 6.8 (medium) comes from the advisory's metadata. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a46bd6e9-4037-…13-b36d-e418a2ed41b7 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113492	The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113492The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that can expose sensitive data to people who are not logged in. The advisory rates it medium severity with a CVSS score of 5.3. The fix is to update the plugin to version 2.8.194 or later. Technical summary The flaw is a sensitive data disclosure, classified as CWE-200, in which one of the plugin's unauthenticated AJAX handlers loads listings without performing status, ownership, or password checks. The advisory states it can be reached without authentication, and the affected version range is given only as before 2.8.194. The fixed version is 2.8.194. The advisory does not state any workaround. It does not state whether exploitation in the wild has been observed, and it gives no detection guidance. The advisory text is truncated, so the full description of the affected handler is not available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/5a1c17a0-c513-…64-91c7-09c0f1878c71 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.4	CVE-2026-113491	The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113491The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a path traversal flaw that can allow an attacker to misuse file handling on a website. The advisory lists the fix as version 2.8.194 and gives a medium severity score of 6.4, with no further impact details stated. Technical summary The flaw is a path traversal (CWE-22) in the GeoDirectory WordPress plugin before 2.8.194, where a user-supplied image URL is used as a local file path when saving a front-end listing without validation. The advisory states the issue allows access through this path, but the exact impact is cut off in the text. The attack vector, required privileges, and user interaction are not stated. The fixed version is 2.8.194, and the advisory lists a CVSS score of 6.4 (medium). No workaround and no detection guidance are stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ba2114a5-01e3-…e7-a7f6-673674b6501d Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113490	The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113490The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, can expose information about listings to people who should not see it. The advisory rates the issue medium severity with a CVSS score of 5.3, and the fix is to update to version 2.8.194. Technical summary The flaw is a missing status or ownership check (CWE-200, sensitive information disclosure) when a listing's map popup is rendered through a single-item REST endpoint in the GeoDirectory plugin. The advisory states the plugin is affected before 2.8.194 and fixed in 2.8.194. The attack vector, required privileges, and exact data exposed are not stated beyond the classification. Workarounds are not stated. Detection guidance is not stated. The CVSS score given is 5.3 (medium). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2901f8f3-0b35-…65-b248-6c0dfc5de894 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	4.3	CVE-2026-113489	The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113489The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets low-privileged logged-in users (Subscriber level) reference attachments they do not own when saving a listing. The advisory rates it medium severity with a CVSS score of 4.3, and the fix is to update the plugin to version 2.8.194. Technical summary The weakness is an insecure direct object reference (CWE-639, broken access control) in which the plugin does not verify that a referenced attachment belongs to the listing being saved. The attack requires an account with Subscriber-level access and the advisory states the attacker can exploit it from there. The plugin is fixed in version 2.8.194, and the advisory says the flaw exists in versions before 2.8.194. The advisory does not state any workaround or mitigation, and it gives no detection guidance or exploitation-in-the-wild information. The rest of the advisory text lists unrelated plugin vulnerabilities from other vendors, which are not part of this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2f539d43-6f95-…4f-b399-21697145591e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects