CVE-2026-16988

The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.

The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.

The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).