Stored Cross-Site Scripting in GeoDirectory Plugin for WordPress

CVE-2026-110703

What is CVE-2026-110703?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'post_content' parameter. Authenticated attackers, with subscriber-level access and above, can exploit this vulnerability to inject malicious web scripts into published listings. The ownership check within the plugin restricts payload storage to owners of the listings; however, existing listings maintain their post status during edits, allowing attackers to circumvent moderation and exploit the vulnerability without requiring re-approval for malicious content.

References