GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing File Upload Fields
- ID
- WPSEC-2026-1851
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.198
- Remediation
- Update to 2.8.198 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing image and file upload fields in all versions up to, and including, 2.8.197. This is due to the image URL, image ID and file name being concatenated into HTML in the upload thumbnail script without escaping or URL validation, and to stored titles and captions not having the edit string's delimiters neutralised. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute when a user views the affected listing's upload field, such as when editing the listing.
References
- https://wpsec.com/vuln/WPSEC-2026-1851/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.198/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS