paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

• CVE-2026-120082 High 7.2 GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content –
• CVE-2026-116752 Medium 6.4 GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection 0.3%
• CVE-2026-119113 Medium 6.4 GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter 0.4%
• CVE-2026-118635 Medium 6.5 GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter 0.4%
• CVE-2026-110703 Medium 6.4 GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute 0.2%
• CVE-2026-111069 Medium 6.4 GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field 0.2%
• CVE-2026-107650 Medium 6.4 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title 0.3%
• CVE-2026-107754 Medium 6.4 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title 0.3%
• CVE-2026-104899 High 8.1 GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter 0.6%
• CVE-2026-104993 Medium 6.4 GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field 0.2%
• CVE-2026-103913 High 7.5 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing 0.4%
• CVE-2026-96766 Medium 6.4 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter 0.2%
• CVE-2026-93897 Medium 6.4 GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') 0.2%
• CVE-2026-19091 High 8.1 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision 1.1%
• CVE-2025-12833 Medium 4.3 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment 0.2%
• CVE-2024-13507 High 7.5 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection 0.5%
• CVE-2024-13506 Medium 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter 0.4%
• CVE-2024-3732 Medium 6.4 GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode 0.3%