CVE-2026-93897
MediumCVSS 6.4Summary
The GeoDirectory plugin for WordPress (versions up to and including 2.8.181) is vulnerable to Stored Cross-Site Scripting via a Text-type Custom Field (e.g., 'phone'). Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can inject malicious scripts that execute whenever a user accesses the injected page.
Risk Assessment
A low-privileged attacker can persistently inject malicious JavaScript, potentially leading to session theft, account takeover, or modification of content visible to other users.
Recommendation
Update the GeoDirectory plugin to a version newer than 2.8.181 as soon as a fix is available, and consider restricting the ability to edit custom fields for low-privileged users.
Other vulnerabilities in GeoDirectory WordPress Plugin
See all- CVE-2026-16988High
The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
- CVE-2025-15677Low
The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).
Original NVD description (English source)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.