# GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.205 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Image Title in Lightbox

- **ID:** WPSEC-2026-3091
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.206
- **Fixed in:** 2.8.206 (Update to 2.8.206 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3091/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via listing image titles, captions and alt text in all versions up to, and including, 2.8.205. This is due to the legacy-design lightbox script reading these values back from the image's attributes, where the browser has already decoded HTML entities, and putting them into the lightbox caption and image markup without escaping. This makes it possible for authenticated attackers with subscriber-level access and above, who can submit listings with images, to inject arbitrary web scripts that run when a user opens the image in the lightbox.

## References

- https://wpsec.com/vuln/WPSEC-2026-3091/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.206/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3091/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.