CVE-2026-93897
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.
Risk Assessment
A low-privileged attacker can persistently inject malicious JavaScript, potentially leading to session theft, account takeover, or modification of content visible to other users.
Recommendation
Update the GeoDirectory plugin to a version newer than 2.8.181 as soon as a fix is available, and consider restricting the ability to edit custom fields for low-privileged users.
Other vulnerabilities in GeoDirectory WordPress Plugin
See all- CVE-2026-119113Medium
The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.
- CVE-2026-118635Medium
The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-114270Medium
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
- CVE-2026-113489Medium
The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
- CVE-2026-16988High
The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
- CVE-2025-15677Low
The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).
Original NVD description (English source)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS