CVE-2026-104993
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.
Risk Assessment
The risk includes the possibility of injecting malicious scripts on listing pages, which could lead to data theft, session hijacking, or malware distribution. The attack can affect visitors to pages with listings that contain the infected email field.
Recommendation
Update the GeoDirectory plugin to the latest patched version. Also carefully review and approve user submissions and consider restricting subscriber privileges.
Other vulnerabilities in GeoDirectory
See all- CVE-2026-66604High
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.
- CVE-2026-84813Critical
Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-39512Critical
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
- CVE-2026-104899High
The GeoDirectory plugin for WordPress up to version 2.8.187 is vulnerable to Local File Inclusion (LFI) via the 'design_type' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially leading to access control bypass, sensitive data disclosure, or code execution.
- CVE-2026-103913High
The GeoDirectory plugin for WordPress is vulnerable to SQL injection via stored latitude/longitude coordinates of a listing in versions up to and including 2.8.186. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is possible through the public wp_ajax_nopriv_geodir_widget_listings handler with set_post and sort_by parameters.
- CVE-2026-96766Medium
The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to and including 2.8.183 due to insufficient input sanitization and output escaping. The AJAX save handler validates only post authorship and a nonce with no additional capability check.
- CVE-2026-81271High
Unauthenticated CSRF vulnerability in GeoDirectory plugin versions up to 2.8.176. An attacker can exploit CSRF to perform unwanted actions in the context of a logged-in administrator.
- CVE-2026-68565Medium
Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.
- CVE-2026-19091High
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
- CVE-2026-16968Medium
The GeoDirectory WordPress plugin before version 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
Original NVD description (English source)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS