GeoDirectory EUVD-2026-86533

Requires an authenticated account of at least subscriber level on a site running GeoDirectory <=2.8.181, plus the ability to save a listing carrying a text-type custom field (e.g., 'phone') through the AJAX geodir_save_post endpoint. The specific technique is submitting entity-encoded angle brackets (&lt;img src=x onerror=alert(1)&gt;) so the payload evades the plugin's strpos()-gated tag-stripping and is stored, then executes when any user renders the affected page. Limiting factors: an account is needed (PR:L), and the payload only fires when a victim views the injected listing (execution deferred to page render). Practical risk rises sharply on the common configuration where the site permits open user/lister self-registration, making the required subscriber account trivial to obtain.

This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) accurately reflects a stored XSS: network-reachable and low-complexity, but gated by authentication (PR:L requires at least subscriber-level access) with a scope change (S:C) because injected script executes in the browsers of other users/visitors who view the page. Impact is limited to C:L/I:L with no availability impact, consistent with typical XSS. No EPSS score, no CISA KEV listing, and no public POC were supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The technical writeup is unusually detailed (naming the geodir_save_post AJAX endpoint and the entity-encoded-angle-bracket bypass of the strpos()-gated tag-strip), which lowers the bar for a researcher to reproduce, but that is not the same as active exploitation. There is a mild real-world amplifier: many GeoDirectory deployments allow open user registration so listers can submit business entries, meaning the required subscriber account is often trivially self-obtainable - this raises practical risk closer to unauthenticated than the PR:L metric alone implies. No signals conflict; the main gap is the absence of EPSS/KEV/POC data to gauge exploitation likelihood. Net: patch in the normal cycle, prioritize on sites with open registration.

An attacker registers a subscriber (or contributor/lister) account on a GeoDirectory-powered site, then submits or edits a listing, placing an entity-encoded payload such as &lt;img src=x onerror=alert(1)&gt; into a text custom field like 'phone' via the geodir_save_post AJAX endpoint; the encoding slips past the plugin's strpos()-based tag-stripping check and is stored. When any visitor or administrator later views that listing page, the script executes in their browser, enabling session/cookie theft or admin-context actions. No public POC is referenced, but the advisory documents the exact bypass technique.