{
 "id": "WPSEC-2026-3091",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3091/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3091/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3091/index.md",
 "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.205 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Image Title in Lightbox",
 "description": "The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing image titles, captions and alt text in all versions up to, and including, 2.8.205. This is due to the legacy-design lightbox script reading these values back from the image's attributes, where the browser has already decoded HTML entities, and putting them into the lightbox caption and image markup without escaping. This makes it possible for authenticated attackers with subscriber-level access and above, who can submit listings with images, to inject arbitrary web scripts that run when a user opens the image in the lightbox.",
 "plugin": {
  "slug": "geodirectory",
  "name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
  "wordpress_org": "https://wordpress.org/plugins/geodirectory/",
  "advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.206",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.206"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.206",
 "remediation": "Update to 2.8.206 or later.",
 "fix_released": "2026-11-12T16:30:14+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:53:03.732907+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3091/",
  "https://plugins.svn.wordpress.org/geodirectory/tags/2.8.206/",
  "https://wordpress.org/plugins/geodirectory/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}