CVEspaoltaiaCVE-2026-110703Published Oct 16, 09:26 · Updated Oct 16, 14:13 UTC
6.4
MediumCVSS 3.1 · from Wordfence
CVE-2026-110703

GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · Cross-site scripting · CWE-79
AffectedGeoDirectory – WP Business Directory Plugin and Classified Listings Directory
FixNo fix listed yet.
PublishedOct 16, 09:26 · Wordfence
ScoredOct 16 · 6.4 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.

Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inGeoDirectory – WP Business Directory Plugin and Classified Listings Directoryup to 2.8.191–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.wordfence.com/threat-intel/vulnerabilities/id/2af46137-6cdc-4898-8d59-3c603ebe02c4?source=cve · wordfence.complugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/vendor/ayecode/wp-ayecode-ui/includes/inc/bs5-js.php#L328 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/post-functions.php#L2032 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/class-geodir-post-data.php#L1661 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.191/includes/class-geodir-ajax.php#L821 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/changeset?reponame=&old=3746728%40geodirectory&new=3746728%40geodirectory · plugins.trac.wordpress.org

Other CVEs in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

All 16 →
6.4GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection · CVE-2026-116752Oct 316.4GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter · CVE-2026-119113Oct 306.5GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter · CVE-2026-118635Oct 30