GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.205 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Image Title in Lightbox
- ID
- WPSEC-2026-3091
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.206
- Remediation
- Update to 2.8.206 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing image titles, captions and alt text in all versions up to, and including, 2.8.205. This is due to the legacy-design lightbox script reading these values back from the image's attributes, where the browser has already decoded HTML entities, and putting them into the lightbox caption and image markup without escaping. This makes it possible for authenticated attackers with subscriber-level access and above, who can submit listings with images, to inject arbitrary web scripts that run when a user opens the image in the lightbox.
References
- https://wpsec.com/vuln/WPSEC-2026-3091/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.206/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS