CVE-2025-15677
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).
Risk Assessment
An attacker with editor privileges can inject malicious scripts that execute in the administrator's browser, potentially leading to session hijacking or other harmful actions.
Recommendation
Update the GeoDirectory plugin to version 2.8.110 or later, which includes the fix.
Original NVD description (English source)
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).