GeoDirectory Plugin CVE-2025-15677

Exploitation requires an authenticated WordPress user account with at minimum editor-level role privileges - unauthenticated or subscriber-level access is insufficient. The attacker must have write access to the GeoDirectory plugin's place-category settings interface. A victim administrator must subsequently visit the affected admin page for the stored payload to execute, satisfying the UI:R requirement. The vulnerability has the greatest security significance in WordPress multisite environments where the unfiltered_html capability is intentionally withheld from editors as a trust boundary; in standard single-site installs where editors are implicitly trusted with HTML content, the incremental security impact is limited. No special network conditions, non-standard ports, or specific server configurations are required beyond a functioning WordPress installation with GeoDirectory active.

The official CVSS 3.1 score of 3.5 (Low) accurately reflects the constrained attack surface: PR:H requires the attacker to already hold editor-level or higher WordPress credentials, and UI:R requires a more-privileged administrator to visit the poisoned admin page. EPSS at 0.16% (6th percentile) is consistent with this low practical exploitation probability. SSVC reinforces deprioritization: exploitation status is 'none,' the attack is not automatable, and technical impact is only partial. The availability of a public POC via WPScan marginally elevates the risk over a no-POC baseline, but does not change the fundamental constraint that a privileged insider or compromised editor account is a prerequisite. Real-world priority is highest in WordPress multisite environments where editor role separation is a deliberate security control - in single-site installs where editors are already implicitly trusted, the incremental risk is negligible. No conflict between CVSS metrics and the description is detected.

An attacker with a compromised or maliciously obtained WordPress editor account navigates to the GeoDirectory place-category settings and injects a JavaScript payload (e.g., a cookie-stealing script) into the category name field. When a site administrator later visits the affected admin page, the stored payload executes in their browser, potentially capturing the admin session token for account takeover. A public POC demonstrating this attack path is available via WPScan.