GeoDirectory CVE-2026-116752

Requires an authenticated account at subscriber level or above on the target site (so public registration or provisioned accounts must exist). The attacker injects the payload via the 'post_images' parameter when creating or editing a listing; the stored script does not fire for the attacker. Exploitation is gated on an Administrator or Editor subsequently opening the attacker's pending listing in the wp-admin edit screen - this editorial-moderation dependency is the key limiting factor, meaning the payload only triggers against privileged users during normal review workflow rather than against arbitrary site visitors. All GeoDirectory versions up to and including 2.8.197 are affected.

This is a medium-severity (CVSS 6.4) authenticated stored XSS, and the signals point to a real but non-emergency issue rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) shows network-reachable, low-complexity exploitation requiring only subscriber-level authentication (PR:L), with a scope change (S:C) reflecting that a low-privileged attacker's payload executes in the context of a higher-privileged Administrator or Editor - the privilege-escalation characteristic that makes this more concerning than a typical self-XSS. Mitigating signals: exploitation requires a valid subscriber account AND an Administrator/Editor to open the attacker's pending listing in the edit screen, so it depends on normal editorial workflow rather than firing automatically against any visitor. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. It is NOT listed in CISA KEV and there is no confirmed working exploit in the supplied data. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-a-normal-cadence posture. No key signals conflict; the main gap is the absence of EPSS and any independently verified fixed version number.

An attacker registers or uses an existing subscriber-level account on a GeoDirectory-powered site and submits a listing with a malicious script injected through the 'post_images' parameter, which is stored without sufficient sanitization or output escaping. When an Administrator or Editor later opens that pending listing's edit screen to moderate it, the stored script executes in their authenticated wp-admin session, enabling actions at their privilege level. No confirmed working public exploit is present in the available data; the references are the Wordfence advisory, plugin source lines, and the fix changeset.