What is the CVSS score of CVE-2025-15677?

CVE-2025-15677 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15677?

Yes, a public proof-of-concept exploit is available for CVE-2025-15677. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2025-15677?

Yes, a patch is available for CVE-2025-15677. Update the affected software to the latest version immediately.

GeoDirectory Plugin CVE-2025-15677

EUVD-2025-210616 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 WPScan

GHSA-x6r7-w9f9-44fh

WordPress XSS Geodirectory

3.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.5 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

3.5 LOW

Editor authentication required (PR:H) and admin must visit the poisoned page (UI:R); only limited confidentiality and integrity impact via stored XSS with no availability effect.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 15:26 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

LOW 3.5

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

AnalysisAI

Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-privileged users to persist malicious JavaScript via the place-category setting, which is rendered unsanitized on admin pages. The vulnerability is specifically significant in WordPress multisite deployments where the unfiltered_html capability is intentionally revoked for editors, as it bypasses that restriction through the plugin's own inadequate output handling. A public proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' indicate no confirmed active exploitation at time of analysis.

Technical ContextAI

The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), arising from the GeoDirectory plugin's failure to sanitize and escape the place-category setting value before rendering it in WordPress admin pages. GeoDirectory (CPE: cpe:2.3:a:unknown:geodirectory:*:*:*:*:*:*:*:*) is a WordPress directory listing plugin. WordPress multisite networks typically restrict the unfiltered_html capability for sub-site editors as a security boundary; this vulnerability undermines that boundary because the XSS vector lies within the plugin's output logic rather than WordPress core's input filtering pipeline. The attack surface is the admin UI, and persistence of the payload in the database is what makes this stored rather than reflected XSS.

RemediationAI

Update the GeoDirectory WordPress plugin to version 2.8.110 or later, which contains the vendor-released patch addressing this stored XSS. This is the definitive and recommended fix. If immediate patching is not feasible, restrict the editor role to only fully trusted users, and consider using a role management plugin to remove place-category edit permissions for sub-administrator roles as a temporary compensating control - note this workaround may disrupt legitimate content management workflows. The WPScan advisory with full technical details is available at https://wpscan.com/vulnerability/bb6daced-3ee3-4ec7-a221-9981cd85285a/. No workaround fully substitutes for upgrading to 2.8.110.