GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables
- ID
- WPSEC-2026-0788
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- from 2.0.0 before 2.8.191
- Remediation
- Update to 2.8.191 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing field values substituted into %%field%% variables of Dynamic Content and custom Single Tabs templates in versions 2.0.0 up to, and including, 2.8.190 due to insufficient output escaping of the replaced values. Text field values keep quote characters, so they can break out of an HTML attribute when a site's template places the variable inside one. This makes it possible for authenticated attackers, with subscriber-level access and above where front-end listing submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0788/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.191/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS