CVE-2026-104993

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.

Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.

GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.

The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.

The GeoDirectory plugin for WordPress before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes. This allows users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.

The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. This allows unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.