Quick answers
- Is CVE-2026-116752 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116752 being exploited in the wild.
- How severe is CVE-2026-116752?
- Medium severity, with a CVSS score of 6.4, published 31 October 2026.
- Which products and versions are affected?
- AyeCode GeoDirectory up to 2.8.197.
- Is there a fix for CVE-2026-116752?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-116752 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-116752?
- Check whether you run AyeCode GeoDirectory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin contains a stored cross-site scripting vulnerability in the 'post_images' parameter due to insufficient input sanitization and output escaping. The vulnerability affects all versions up to and including 2.8.197 and requires authenticated access at subscriber level or above. Exploitation results in arbitrary JavaScript execution in the browsers of administrators and editors who access affected pending listings, enabling privilege escalation through the normal editorial workflow.
Affected products
- AyeCode GeoDirectory up to 2.8.197
Timeline
- 2026-10-31: disclosed