Geodirectory Wp Business Directory Plugin And Classified Listings Directory
Monthly
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.191) allows authenticated attackers with subscriber-level access or above to inject arbitrary JavaScript into a listing's post_content that then executes in the browser of any visitor viewing that listing page. The attacker must own an already-published listing, because the GeoDir_Post_Data::can_edit() ownership check limits who can store the payload and ajax_save_post() re-applies the existing post_status on edit, so changes to a published listing bypass re-moderation and go live immediately; sites that disable open registration, disallow front-end submissions, or hold listings in moderation are substantially less exposed. This moderate-severity flaw (CVSS 6.4, CWE-79) was reported by Wordfence, and no public exploit identified at time of analysis (it is not listed in CISA KEV).
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.192) allows an authenticated user with Subscriber-level access to inject arbitrary JavaScript into the 'twitterusername' custom field, which is then stored and executed whenever another user - ideally a higher-privileged admin or moderator - views the affected listing page. The only input restriction on that field is a client-side HTML 'pattern' attribute, which is trivially bypassed, while server-side sanitization and output escaping are insufficient. Exploitation is confirmed to require an account with listing-creation privileges and a victim who views the injected listing; no public exploit code has been identified at time of analysis, and the overall risk is assessed as moderate priority.
Stored cross-site scripting in GeoDirectory WordPress plugin versions through 2.8.190 allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts through the 'post_title' parameter, which then execute when a victim views the affected listing or page. Exploitation requires a low-privilege account and site settings that permit listing or post submission, and it is not unauthenticated; no public exploit was identified at time of analysis. The CVSS 6.4 score reflects scoped script execution with low confidentiality and integrity impact.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.190) lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through a submitted listing image title (post_images / file_info[2]). The injected script is persisted in the database and executes in the browser of any user who later views the affected listing or map view, scoring 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script runs in the context of the vulnerable site. Exploitation is gated by the need for a valid low-privilege account (the target site must allow registration or the attacker must already hold credentials) and by a victim subsequently loading the tainted page; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.188) allows authenticated users with subscriber-level access or above to plant arbitrary JavaScript in listing data via the 'Contact Email' custom field, which then executes in the browser of anyone viewing the affected public single-listing page. Exploitation is not a default-configuration issue: the site administrator must first have added and configured the Contact Email custom field (htmlvar_name 'email') to render on public single-listing output and must subsequently approve the attacker's submitted listing before the payload becomes live, which is why the independent assessment rates the vector AC:H and describes this as conditionally exploitable rather than broadly reachable. There is no public exploit code or confirmed active exploitation at time of analysis, and no EPSS or KEV signal accompanies this record; residual risk is concentrated in sites that permit low-privilege registration, accept untrusted listing submissions, and expose the Contact Email field publicly.
Stored cross-site scripting in the GeoDirectory WordPress business directory plugin (all versions up to and including 2.8.183) lets any authenticated subscriber-level user who owns a listing inject arbitrary JavaScript through the 'business_hours' parameter, which is then executed in the browser of any user who views the affected listing page. The AJAX save handler enforces only post authorship plus a nonce and performs no capability check or output escaping, so practical exploitability depends on whether the site allows low-privileged users to register and own listings, a common but not universal GeoDirectory configuration. Authentication is mandatory and impact is confined to browser-context script execution (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), making this a genuine but moderate-severity issue rather than a top-priority emergency; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the GeoDirectory WordPress business-directory and classified-listings plugin (all versions up to and including 2.8.181) lets an attacker with only a subscriber-level account plant arbitrary JavaScript that runs in the browser of any user who later views the injected listing. The payload is submitted through the AJAX geodir_save_post endpoint into a text-type custom field such as 'phone', using entity-encoded angle brackets to defeat the plugin's strpos()-gated tag-stripping check, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 6.4) reflects a scope change with limited confidentiality and integrity impact and no availability impact. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; practical risk rises sharply on sites that permit open user or lister self-registration, because obtaining the required subscriber account then becomes trivial, and impact is deferred until a victim renders the poisoned page.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.191) allows authenticated attackers with subscriber-level access or above to inject arbitrary JavaScript into a listing's post_content that then executes in the browser of any visitor viewing that listing page. The attacker must own an already-published listing, because the GeoDir_Post_Data::can_edit() ownership check limits who can store the payload and ajax_save_post() re-applies the existing post_status on edit, so changes to a published listing bypass re-moderation and go live immediately; sites that disable open registration, disallow front-end submissions, or hold listings in moderation are substantially less exposed. This moderate-severity flaw (CVSS 6.4, CWE-79) was reported by Wordfence, and no public exploit identified at time of analysis (it is not listed in CISA KEV).
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.192) allows an authenticated user with Subscriber-level access to inject arbitrary JavaScript into the 'twitterusername' custom field, which is then stored and executed whenever another user - ideally a higher-privileged admin or moderator - views the affected listing page. The only input restriction on that field is a client-side HTML 'pattern' attribute, which is trivially bypassed, while server-side sanitization and output escaping are insufficient. Exploitation is confirmed to require an account with listing-creation privileges and a victim who views the injected listing; no public exploit code has been identified at time of analysis, and the overall risk is assessed as moderate priority.
Stored cross-site scripting in GeoDirectory WordPress plugin versions through 2.8.190 allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts through the 'post_title' parameter, which then execute when a victim views the affected listing or page. Exploitation requires a low-privilege account and site settings that permit listing or post submission, and it is not unauthenticated; no public exploit was identified at time of analysis. The CVSS 6.4 score reflects scoped script execution with low confidentiality and integrity impact.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.190) lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through a submitted listing image title (post_images / file_info[2]). The injected script is persisted in the database and executes in the browser of any user who later views the affected listing or map view, scoring 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script runs in the context of the vulnerable site. Exploitation is gated by the need for a valid low-privilege account (the target site must allow registration or the attacker must already hold credentials) and by a victim subsequently loading the tainted page; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.188) allows authenticated users with subscriber-level access or above to plant arbitrary JavaScript in listing data via the 'Contact Email' custom field, which then executes in the browser of anyone viewing the affected public single-listing page. Exploitation is not a default-configuration issue: the site administrator must first have added and configured the Contact Email custom field (htmlvar_name 'email') to render on public single-listing output and must subsequently approve the attacker's submitted listing before the payload becomes live, which is why the independent assessment rates the vector AC:H and describes this as conditionally exploitable rather than broadly reachable. There is no public exploit code or confirmed active exploitation at time of analysis, and no EPSS or KEV signal accompanies this record; residual risk is concentrated in sites that permit low-privilege registration, accept untrusted listing submissions, and expose the Contact Email field publicly.
Stored cross-site scripting in the GeoDirectory WordPress business directory plugin (all versions up to and including 2.8.183) lets any authenticated subscriber-level user who owns a listing inject arbitrary JavaScript through the 'business_hours' parameter, which is then executed in the browser of any user who views the affected listing page. The AJAX save handler enforces only post authorship plus a nonce and performs no capability check or output escaping, so practical exploitability depends on whether the site allows low-privileged users to register and own listings, a common but not universal GeoDirectory configuration. Authentication is mandatory and impact is confined to browser-context script execution (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), making this a genuine but moderate-severity issue rather than a top-priority emergency; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the GeoDirectory WordPress business-directory and classified-listings plugin (all versions up to and including 2.8.181) lets an attacker with only a subscriber-level account plant arbitrary JavaScript that runs in the browser of any user who later views the injected listing. The payload is submitted through the AJAX geodir_save_post endpoint into a text-type custom field such as 'phone', using entity-encoded angle brackets to defeat the plugin's strpos()-gated tag-stripping check, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 6.4) reflects a scope change with limited confidentiality and integrity impact and no availability impact. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; practical risk rises sharply on sites that permit open user or lister self-registration, because obtaining the required subscriber account then becomes trivial, and impact is deferred until a victim renders the poisoned page.