Stored Cross-Site Scripting Vulnerability in GeoDirectory WordPress Plugin

CVE-2026-116752

What is CVE-2026-116752?

The GeoDirectory – WP Business Directory Plugin allows authenticated users with subscriber-level access or higher to exploit a Stored Cross-Site Scripting vulnerability via the 'post_images' parameter. This arises due to inadequate input sanitization and output escaping practices. When a malicious user injects JavaScript payloads into pending listings, those scripts execute when any Administrator or Editor accesses the edit screen of the compromised listing. This vulnerability poses significant risks, as it enables attackers to execute arbitrary scripts in the browsers of users with elevated privileges, effectively allowing for potential privilege escalation and further exploitation of the affected WordPress site.

References