What is the CVSS score of CVE-2026-66604?

CVE-2026-66604 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of GeoDirectory are affected by CVE-2026-66604?

GeoDirectory, a widely-deployed WordPress plugin, contains an unauthenticated cross-site scripting vulnerability in versions 2.8.173 and earlier that allows attackers to hijack administrator sessions…

How to fix or mitigate CVE-2026-66604?

Within 24 hours, conduct a complete audit of all WordPress installations to identify GeoDirectory plugin versions 2.8.173 or earlier and immediately disable the plugin to prevent exploitation. Within 7 days, configure Web Application Firewall rules blocking XSS-pattern requests to GeoDirectory endpoints, establish monitoring for vendor security advisories, and prepare a patched GeoDirectory version in staging environment once available. Within 30 days, deploy the vendor-released patch to production after staging validation, audit administrative account access logs during the vulnerability exposure window for suspicious activity, and implement strict Content Security Policy headers site-wide.

GeoDirectory CVE-2026-66604

EUVD-2026-63343 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-20 Patchstack

GHSA-qxvh-2mjx-7wp3

XSS Geodirectory

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-exploitable with no auth (PR:N) and low complexity, but requires victim interaction (UI:R); availability impact set to N as XSS does not meaningfully degrade system availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 12:39 vuln.today

CVE Published

Aug 20, 2026 - 12:07 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

AnalysisAI

Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Submit crafted XSS payload via unauthenticated GeoDirectory input

Delivery

Payload stored in or reflected by plugin output

Exploit

Attacker delivers or waits for victim admin to load affected page

Execution

Injected JavaScript executes in victim's authenticated browser session

Impact

Session credentials or admin actions exfiltrated to attacker