Stored Cross-Site Scripting Vulnerability in GeoDirectory Plugin for WordPress
CVE-2026-107754

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Geodirectory – WP Business Directory Plugin And Classified Listings Directory
Vendor
CVE Published:
14 October 2026

What is CVE-2026-107754?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the 'post_images (file_info[2] = title)' parameter across all versions up to and including 2.8.190. Authenticated attackers with subscriber-level access can exploit this vulnerability to inject arbitrary web scripts into pages, leading to script execution that occurs every time a user visits the compromised page. This raises significant security concerns, especially for site administrators and users.

Affected Version(s)

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 0 <= 2.8.190

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/geodirectory/t...
https://plugins.trac.wordpress.org/browser/geodirectory/t...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sawyer
.