CVE-2026-114270
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Risk Assessment
An attacker can access content of listings that should be password-protected, potentially leading to information leakage. The risk affects sites using password protection to restrict access to listings.
Recommendation
Update the GeoDirectory plugin to version 2.8.197 or later. Until updated, consider removing password protection or restricting access to protected listings.
Other vulnerabilities in GeoDirectory WordPress plugin
See all- CVE-2026-119113Medium
The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.
- CVE-2026-118635Medium
The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-113489Medium
The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
- CVE-2026-93897Medium
The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.
- CVE-2026-16988High
The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
- CVE-2025-15677Low
The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).
Original NVD description (English source)
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS