Stored Cross-Site Scripting in GeoDirectory Plugins for WordPress

CVE-2026-111069

What is CVE-2026-111069?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress are susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping in the 'twitterusername' parameter. This vulnerability affects all versions up to and including 2.8.192. Authenticated attackers with subscriber-level access can exploit this flaw to inject arbitrary web scripts into pages, triggering execution whenever a user visits the compromised page. The issue arises because the client-side HTML pattern enforcing alphanumeric-only input for the twitterusername field is not validated server-side, allowing malicious listing owners to submit attribute-breakout payloads that bypass existing sanitation protocols and are subsequently stored in the custom field table.

References