EUVD-2026-60934
GHSA-86c6-9r5q-95h3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Network-delivered stored XSS requiring contributor auth (PR:L) and admin viewing (UI:R); scope change to admin browser session justifies S:C with low-tier impacts.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
AnalysisAI
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold a Contributor-level (or equivalent) WordPress account on the target site, satisfying the PR:L prerequisite in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L correctly reflects the attack profile: network-reachable, low complexity, low-privilege requirement (contributor account), but dependent on a privileged user viewing the injected content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a contributor-level account on a GeoDirectory-powered WordPress site, then submits a business listing or directory entry containing a crafted XSS payload in an unsanitized field (e.g., listing description or custom metadata). When an administrator reviews, approves, or edits the submission through the WordPress dashboard or frontend, the malicious script silently executes in their browser - capturing the admin's session cookie or WordPress nonce and forwarding it to an attacker-controlled server, granting full administrative access. … |
| Remediation | Update GeoDirectory to a version above 2.8.172 as soon as the vendor releases a patched build; patch availability is indicated by the Patchstack report but an exact fixed version number was not confirmed in the available intelligence - check the plugin's official WordPress.org changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-172-cross-site-scripting-xss-vulnerability for the specific fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geodirectory
View allInformation disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all register
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before o
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Sc
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated atta
Missing Authorization vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectl
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDir
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPres
Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-priv
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a S
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers
Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today