Paolo
Monthly
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36951; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. Given the WordPress plugin ecosystem's history of rapid weaponization for SQLi flaws, this should be treated as a priority despite the absence of confirmed in-the-wild activity.
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.
Server-Side Request Forgery (SSRF) in the GeoDirectory WordPress plugin (versions 2.8.161 and earlier) allows authenticated subscribers to force the server to issue arbitrary internal or external HTTP requests. Because the vulnerability is accessible at the lowest WordPress registered-user privilege level (subscriber), any registered site user can trigger it without elevated permissions. No public exploit or CISA KEV entry has been identified at time of analysis, but the Scope:Changed CVSS rating confirms the impact extends beyond the WordPress application itself to backend infrastructure reachable from the server.
Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers to invoke privileged plugin operations without any credential requirement, resulting in partial integrity and availability impact on directory listings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, network-accessible exploitation requiring no user interaction, reported by Patchstack under the 'Authentication Bypass' tag. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority patch tier for any WordPress deployment running a public-facing GeoDirectory instance.
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36951; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. Given the WordPress plugin ecosystem's history of rapid weaponization for SQLi flaws, this should be treated as a priority despite the absence of confirmed in-the-wild activity.
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.
Server-Side Request Forgery (SSRF) in the GeoDirectory WordPress plugin (versions 2.8.161 and earlier) allows authenticated subscribers to force the server to issue arbitrary internal or external HTTP requests. Because the vulnerability is accessible at the lowest WordPress registered-user privilege level (subscriber), any registered site user can trigger it without elevated permissions. No public exploit or CISA KEV entry has been identified at time of analysis, but the Scope:Changed CVSS rating confirms the impact extends beyond the WordPress application itself to backend infrastructure reachable from the server.
Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers to invoke privileged plugin operations without any credential requirement, resulting in partial integrity and availability impact on directory listings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, network-accessible exploitation requiring no user interaction, reported by Patchstack under the 'Authentication Bypass' tag. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority patch tier for any WordPress deployment running a public-facing GeoDirectory instance.