GeoDirectory CVE-2026-107650

Exploitation requires an authenticated WordPress account with subscriber-level privileges or higher (CVSS PR:L) on a site running GeoDirectory, plus the ability to submit a directory listing/post supplying the 'post_title' value - typically available where front-end listing submission or user registration is enabled (common on directory sites). The payload is stored and then executes only when another user or administrator subsequently views the injected page, so successful impact depends on a victim accessing that content. Limiting factors: attacker must obtain a valid low-privilege account, the site must permit the relevant listing/post submission, and a victim with a useful session must render the injected title; this is not remote-unauthenticated exploitation.

This is a moderate-severity stored XSS (CVSS 6.4, CWE-79) reported by Wordfence, a credible WordPress-focused source. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L = authenticated subscriber-level account), with a scope change (S:C) reflecting that the injected script executes in the browsers of other users/visitors rather than affecting only the vulnerable app. Impact is limited (C:L/I:L, A:N) - consistent with script execution in a victim's session rather than full server compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the practical risk is tempered by the requirement for an attacker-controlled authenticated account and the need for a victim to view the injected page. Net assessment: a real but not emergency-priority issue - patch in normal cadence. The main risk amplifier is that subscriber-level self-registration is common on directory/listing sites, lowering the bar to obtain the needed PR:L access; the main limiter is the absence of any exploitation-in-the-wild signal.

An attacker registers or uses an existing subscriber-level account on a WordPress site running GeoDirectory and submits a directory listing whose 'post_title' contains a malicious script payload, which is stored without adequate sanitization. When a site administrator or other visitor views the page rendering that title, the script executes in their browser session, enabling actions such as session/cookie theft or admin-context actions. No public exploit code was provided in the input.