GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · Cross-site scripting · CWE-79

AffectedGeoDirectory – WP Business Directory Plugin and Classified Listings Directory

FixNo fix listed yet.

PublishedOct 30, 17:15 · Wordfence

ScoredOct 30 · 6.4 · Wordfence

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

From Wordfence

Affected and fixed versions

ProductAffectedFixed inGeoDirectory – WP Business Directory Plugin and Classified Listings Directoryup to 2.8.199–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Other CVEs in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

All 16 →

6.4GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection · CVE-2026-116752Oct 31 6.5GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter · CVE-2026-118635Oct 30 6.4GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute · CVE-2026-110703Oct 16