Arbitrary Shortcode Execution Vulnerability in GeoDirectory Plugin for WordPress
CVE-2026-118635

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Geodirectory – WP Business Directory Plugin And Classified Listings Directory
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118635?

The GeoDirectory Plugin for WordPress is susceptible to a vulnerability that allows for arbitrary shortcode execution. This flaw is present in all versions of the plugin up to and including 2.8.198, due to insufficient validation of user inputs before executing the do_shortcode function. This oversight enables unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized actions within the website. Website administrators using the affected versions are advised to implement updates and review their security measures to mitigate potential risks.

Affected Version(s)

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 0 <= 2.8.198

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/geodirectory/t...
https://plugins.trac.wordpress.org/browser/geodirectory/t...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.