# GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables

- **ID:** WPSEC-2026-0788
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** from 2.0.0 before 2.8.191
- **Fixed in:** 2.8.191 (Update to 2.8.191 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-09
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0788/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing field values substituted into %%field%% variables of Dynamic Content and custom Single Tabs templates in versions 2.0.0 up to, and including, 2.8.190 due to insufficient output escaping of the replaced values. Text field values keep quote characters, so they can break out of an HTML attribute when a site's template places the variable inside one. This makes it possible for authenticated attackers, with subscriber-level access and above where front-end listing submission is enabled, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-0788/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.191/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0788/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.