All vulnerabilities
CVE-2026-107650

GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Text from CVE List

Affected versions 1

  • GeoDirectory – WP Business Directory Plugin and Classified Listings Directoryaffected: all versions through 2.8.190CVE List

References 7