GeoDirectory EUVD-2026-102831

Exploitation requires an authenticated account with subscriber-level access or above (PR:L) AND the attacker must OWN an already-published listing, because the GeoDir_Post_Data::can_edit() ownership check restricts who can store the payload - a new or pending submission would normally face moderation. The specific abusable condition is that ajax_save_post() re-applies the existing post_status on edit, so modifying an already-published listing bypasses re-moderation and the injected 'post_content' script is served immediately. Limiting factors: requires valid authentication and prior listing ownership/publication, so sites that disable open registration, do not allow front-end listing submission, or hold all listings in moderation are substantially less exposed. The payload executes passively when any user views the injected listing page.

This is a moderate-severity stored XSS (CVSS 6.4, CWE-79) reported by Wordfence against the GeoDirectory WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation by an authenticated low-privileged (PR:L, subscriber-level) attacker with a changed scope and low confidentiality/integrity impact. No EPSS score, KEV listing, or public POC was provided; this vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation. The practical risk is tempered by meaningful preconditions the raw CVSS does not fully capture: the attacker must already own a PUBLISHED listing because GeoDir_Post_Data::can_edit() enforces an ownership check, so this is not a spray-and-pray flaw. The genuinely notable element is a moderation-bypass: ajax_save_post() re-applies the existing post_status, so edits to an already-published listing skip re-moderation and the payload goes live immediately - this is what elevates it from theoretical to realistically abusable on sites that accept user-submitted listings. Signals are internally consistent (low-privilege authenticated stored XSS) with no conflicts; treat as a genuine but non-emergency patch priority, prioritized higher for directory sites with open subscriber registration and publicly viewable listings.

An attacker registers as a subscriber on a GeoDirectory-powered site and gets a listing published (or already owns one). They then edit the listing's 'post_content' with a malicious script payload; because ajax_save_post() preserves the published status, the edit bypasses re-moderation and goes live instantly. Any visitor or administrator who views the listing page executes the attacker's JavaScript in their browser session. No public POC was provided in the input data.