Stored Cross-Site Scripting in GeoDirectory WordPress Plugin

CVE-2026-120082

What is CVE-2026-120082?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is susceptible to stored cross-site scripting due to inadequate sanitization and escaping of input parameters, particularly the 'post_content'. Attackers can exploit this flaw to inject arbitrary scripts, which execute when a user accesses a compromised page. This vulnerability is exacerbated by nested shortcode payloads that can evade existing guards, highlighting the necessity for thorough input validation and output sanitization to ensure the safety of users accessing the WordPress site.

References