# GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing File Upload Fields

- **ID:** WPSEC-2026-1851
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.198
- **Fixed in:** 2.8.198 (Update to 2.8.198 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1851/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing image and file upload fields in all versions up to, and including, 2.8.197. This is due to the image URL, image ID and file name being concatenated into HTML in the upload thumbnail script without escaping or URL validation, and to stored titles and captions not having the edit string's delimiters neutralised. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute when a user views the affected listing's upload field, such as when editing the listing.

## References

- https://wpsec.com/vuln/WPSEC-2026-1851/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.198/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1851/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.