CVE-2026-116752
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.
Risk Assessment
An attacker with a subscriber account can execute arbitrary JavaScript in the browser of an administrator or editor, potentially leading to takeover of higher-privileged accounts. The vulnerability is particularly dangerous as it leverages the normal editorial workflow.
Recommendation
Update the GeoDirectory plugin to a version later than 2.8.197. Additionally, consider restricting the ability for subscribers to add listings or implementing additional input validation.
Other vulnerabilities in GeoDirectory
See all- CVE-2026-66604High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
- CVE-2026-84813Critical
Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-39512Critical
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
- CVE-2026-113494Low
The GeoDirectory plugin for WordPress before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes. This allows users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
- CVE-2026-113488Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
- CVE-2026-113487Medium
The GeoDirectory plugin for WordPress before 2.8.196 does not properly sanitize or escape a post badge click-through link value before outputting it in an anchor element on a listing. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
- CVE-2026-113674Low
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. This allows unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
- CVE-2026-113673High
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
- CVE-2026-113493Medium
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
- CVE-2026-113492Medium
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers. This allows unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Original NVD description (English source)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS