Stored Cross-Site Scripting Vulnerability in GeoDirectory WordPress Plugin
CVE-2026-107650

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Geodirectory – WP Business Directory Plugin And Classified Listings Directory
Vendor
CVE Published:
14 October 2026

What is CVE-2026-107650?

The GeoDirectory – WP Business Directory and Classified Listings Directory plugins for WordPress contain a vulnerability allowing stored cross-site scripting. This issue arises from inadequate input sanitization and output escaping associated with the 'post_title' parameter in all versions up to and including 2.8.190. Authenticated attackers with subscriber-level access or above can exploit this vulnerability to inject arbitrary scripts, putting users at risk when visiting affected pages. It is advisable for users to update their plugins to the latest secure versions to mitigate this risk.

Affected Version(s)

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 0 <= 2.8.190

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/geodirectory/t...
https://plugins.trac.wordpress.org/browser/geodirectory/t...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrien Brunner
.