CVEspaoltaiaCVE-2026-116752Published Oct 31, 09:29 · Updated Nov 1, 17:34 UTC
6.4
MediumCVSS 3.1 · from Wordfence
CVE-2026-116752

GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · Cross-site scripting · CWE-79
AffectedGeoDirectory – WP Business Directory Plugin and Classified Listings Directory
FixNo fix listed yet.
PublishedOct 31, 09:29 · Wordfence
ScoredOct 31 · 6.4 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.

Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inGeoDirectory – WP Business Directory Plugin and Classified Listings Directoryup to 2.8.197–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.wordfence.com/threat-intel/vulnerabilities/id/197252d7-3098-43cd-b680-3d857ddb29ba?source=cve · wordfence.complugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/includes/class-geodir-media.php#L1264 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/includes/class-geodir-post-data.php#L329 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/assets/aui/js/geodirectory-plupload.js#L363 · plugins.trac.wordpress.orgplugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/templates/bootstrap/file-upload.php#L44 · plugins.trac.wordpress.orggithub.com/AyeCode/geodirectory/archive/refs/heads/master.zip · github.complugins.trac.wordpress.org/changeset/3768833/geodirectory/trunk/assets/aui/js/geodirectory-plupload.js · plugins.trac.wordpress.org

Other CVEs in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

All 16 →
6.4GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter · CVE-2026-119113Oct 306.5GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter · CVE-2026-118635Oct 306.4GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute · CVE-2026-110703Oct 16