CVE-2026-107754

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.

Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.

GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.191) is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the attacker to own a published listing, but edits to an already-published listing bypass re-moderation and remain live immediately.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GeoDirectory plugin for WordPress up to version 2.8.187 is vulnerable to Local File Inclusion (LFI) via the 'design_type' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, potentially leading to access control bypass, sensitive data disclosure, or code execution.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.

The GeoDirectory plugin for WordPress is vulnerable to SQL injection via stored latitude/longitude coordinates of a listing in versions up to and including 2.8.186. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is possible through the public wp_ajax_nopriv_geodir_widget_listings handler with set_post and sort_by parameters.

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to and including 2.8.183 due to insufficient input sanitization and output escaping. The AJAX save handler validates only post authorship and a nonce with no additional capability check.

Unauthenticated CSRF vulnerability in GeoDirectory plugin versions up to 2.8.176. An attacker can exploit CSRF to perform unwanted actions in the context of a logged-in administrator.