CVE-2026-16988

HighCVSS 7.5

Published: 09/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 09/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

Risk Assessment

The risk includes disclosure of sensitive location information of non-public listings, which may violate user privacy and organizational security.

Recommendation

It is recommended to immediately update the GeoDirectory plugin to version 2.8.169 or later, which includes the security fix.

Other vulnerabilities in GeoDirectory WordPress plugin

CVE-2025-15677Low
The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).

Original NVD description (English source)

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.