{
 "id": "WPSEC-2026-0788",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0788/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0788/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0788/index.md",
 "title": "GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing field values substituted into %%field%% variables of Dynamic Content and custom Single Tabs templates in versions 2.0.0 up to, and including, 2.8.190 due to insufficient output escaping of the replaced values. Text field values keep quote characters, so they can break out of an HTML attribute when a site's template places the variable inside one. This makes it possible for authenticated attackers, with subscriber-level access and above where front-end listing submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.8.191",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.8.191"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.8.191",
 "remediation": "Update to 2.8.191 or later.",
 "fix_released": "2026-10-09T11:03:16+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:23.002804+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0788/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.191/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}