GeoDirectory EUVD-2026-96054

Requires an authenticated account with subscriber-level access or above (PR:L) plus a chain of administrator-controlled preconditions that significantly limit exploitation: the administrator must have added and configured the 'Contact Email' custom field (htmlvar_name 'email') to render on the public single-listing output page, AND the administrator must subsequently approve the attacker's submitted listing before the payload becomes live. Practically this means the site must allow low-privilege user registration and user-submitted listings, and must use the Contact Email field in public output. Sites that do not expose that field publicly, auto-reject/do not approve untrusted submissions, or disable open registration are not realistically exploitable. This is not a default-configuration, remote-unauthenticated issue.

This is a moderate, conditionally-exploitable Stored XSS (CWE-79) in the GeoDirectory WordPress plugin, and the signals are internally consistent rather than conflicting. The NVD/Wordfence CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4 Medium) correctly reflects an authenticated (subscriber-level, PR:L) stored payload that crosses scope (S:C) to execute in the browsers of other site visitors with limited confidentiality/integrity impact. However, the raw CVSS understates the real precondition burden: per the description, exploitation only works if an administrator has (a) added and configured the Contact Email custom field to render on the public single-listing page AND (b) manually approves the attacker's submitted listing - two conditions outside the attacker's control that argue for a higher attack complexity than the AC:L in the published vector. No EPSS score, KEV entry, or public POC was provided in the intelligence, so exploitation is 'no public exploit identified at time of analysis.' Net judgment: this is NOT a drop-everything priority. It is a legitimate but low-urgency patch - a privilege-requiring, config-dependent, approval-gated stored XSS with only partial impact. Prioritize normal patch-cycle remediation rather than emergency response, but note that sites allowing open user registration plus listing submission are the realistic exposure surface.

On a GeoDirectory site that permits subscriber registration and public listing submissions, an attacker registers a low-privilege account and submits a business/classified listing whose Contact Email custom field contains a crafted XSS payload. If the administrator has configured that field to appear on the public single-listing page and then approves the pending listing, the script executes in the browser of every visitor (including administrators) who views that listing. No public exploit code was identified, but the technique is a standard stored-XSS listing-submission flow.