Stored Cross-Site Scripting Vulnerability in GeoDirectory Plugin for WordPress
CVE-2026-104993

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Geodirectory – WP Business Directory Plugin And Classified Listings Directory
Vendor
CVE Published:
10 October 2026

What is CVE-2026-104993?

The GeoDirectory plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input validation and insufficient output escaping on the 'email' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability by injecting harmful scripts that execute when a user views affected pages. Exploitation is contingent upon an administrator enabling the Contact Email custom field on the public listing output, allowing attackers to submit malicious listings that the administrator later approves.

Affected Version(s)

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 0 <= 2.8.188

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/geodirectory/t...
https://plugins.trac.wordpress.org/browser/geodirectory/t...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tai Ha (superx)
.