{"metadata": {"vulnerability": "CVE-2026-110703", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-14T14:23:08.631Z", "date_only": false, "value": "2026-10-14T14:23:08.631Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110703", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:39:01Z", "date_only": false, "value": "2026-10-14T14:39:01.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110703", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T20:54:50Z", "date_only": false, "value": "2026-10-15T20:54:50.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110703", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T09:26:37.351Z", "date_only": false, "value": "2026-10-16T09:26:37.351Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110703", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T09:26:37.351Z", "date_only": false, "value": "2026-10-16T09:26:37.351Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-110703", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T09:41:23.115Z", "date_only": false, "value": "2026-10-16T09:41:23.115021Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117449928382751753", "record": "CVE-2026-110703", "field": "creation_timestamp", "uuid": "4f3388f8-8904-46f7-8585-d08596ee01bb", "content": "CVE-2026-110703 GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute The GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110703https://www.wordfence.com/threat-intel/vulnerabilities/id/2af46137-6cdc-4898-8d59-3c603ebe02c4?source=cvehttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/vendor/ayecode/wp-ayecode-ui/includes/inc/bs5-js.php#L328https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/post-functions.php#L2032https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/class-geodir-post-data.php#L1661https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/class-geodir-ajax.php#L821https://plugins.trac.wordpress.org/changeset?reponame=&old=3746728%40geodirectory&new=3746728%40geodirectory#wordpress #paoltaia #GeoDirectory\u2013WPBusinessDirectoryPluginandClassifiedListingsDirectory#CVE_2026_110703#bot", "url": "https://infosec.exchange/users/cve/statuses/117449928382751753"}, {"timestamp": "2026-10-16T10:18:05Z", "date_only": false, "value": "2026-10-16T10:18:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X86J-GH72-FXVV", "record": "GHSA-X86J-GH72-FXVV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T10:18:05.447Z", "date_only": false, "value": "2026-10-16T10:18:05.447", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110703", "record": "FKIE_CVE-2026-110703", "field": "published"}, {"timestamp": "2026-10-16T12:31:22Z", "date_only": false, "value": "2026-10-16T12:31:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X86J-GH72-FXVV", "record": "GHSA-X86J-GH72-FXVV", "field": "published"}, {"timestamp": "2026-10-16T12:31:22Z", "date_only": false, "value": "2026-10-16T12:31:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X86J-GH72-FXVV", "record": "GHSA-X86J-GH72-FXVV", "field": "modified"}, {"timestamp": "2026-10-16T14:12:38.758Z", "date_only": false, "value": "2026-10-16T14:12:38.758823Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110703", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:12:38.758Z", "date_only": false, "value": "2026-10-16T14:12:38.758823Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110703", "record": "FKIE_CVE-2026-110703", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:13:09.355Z", "date_only": false, "value": "2026-10-16T14:13:09.355Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110703", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:13:09.355Z", "date_only": false, "value": "2026-10-16T14:13:09.355Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110703", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:51:17.720Z", "date_only": false, "value": "2026-10-16T14:51:17.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110703", "record": "FKIE_CVE-2026-110703", "field": "lastModified"}]}