GeoDirectory EUVD-2026-102788

Exploitation requires an authenticated account with Subscriber-level access or above AND the ability to create or edit a listing (i.e., the site uses GeoDirectory's front-end listing submission, typical for directory/classified sites). The attacker must supply a payload in the 'twitterusername' custom field; the only enforcement of alphanumeric-only input is the client-side HTML 'pattern' attribute, which is trivially bypassed, while server-side sanitization and output escaping are insufficient. Realistic limiting factors: the attacker needs a valid low-privilege account (barrier if open registration is disabled), and the stored payload only causes impact when another user - ideally a higher-privileged admin/moderator - actually views the affected listing page. No special non-default configuration beyond the listing-submission workflow is required.

This is a moderate-priority, authenticated stored XSS (CWE-79) with signals that temper its real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4 MEDIUM) shows network reach and low attack complexity, but the PR:L requirement means an attacker must first hold at least Subscriber-level access on the target WordPress site - a meaningful barrier on sites with closed registration, though trivial on sites allowing open self-registration (common for directory/listing sites using GeoDirectory). The scope change (S:C) and only Low confidentiality/integrity impact correctly reflect that a payload stored by a low-privileged listing owner executes in the browser of other users (potentially higher-privileged moderators/admins) who view the listing. No KEV listing, no public POC, and no EPSS score were provided, so there is no evidence of active or at-scale exploitation - the SSVC posture is best read as 'Track' rather than 'Act.' The primary escalation path is session/account compromise of an administrator who views the malicious listing, which could then yield fuller control; absent that chain, direct impact is limited. No signals conflict: all sources (Wordfence + source-code references) agree this is a config/sanitization flaw exploitable by authenticated low-privilege users.

An attacker registers (or abuses an existing) Subscriber-level account on a GeoDirectory-powered site and creates/edits a business listing, submitting an attribute-breakout payload in the 'twitterusername' field. Because the alphanumeric restriction is only enforced client-side via the HTML pattern attribute and not validated server-side, the payload is stored in the custom field table and later executes in the browser of any user - including site moderators or administrators - who views that listing page. No public exploit code was identified at time of analysis, but the technique is well-understood and low-complexity.