Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

GeoDirectory plugins let users inject hidden scripts

CVE-2026-93897 · published 1 month ago
Summary

The GeoDirectory Business Directory and Classified Listings plugins for WordPress can let anyone with a subscriber account or higher store malicious code in fields like the phone number. When a visitor opens a page that contains the altered entry, the hidden code runs in their browser, potentially stealing data or hijacking the session. Update the plugins to the latest version or apply the vendor’s fix, and limit content‑editing rights to trusted users while checking existing listings for suspicious entries.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
paoltaia geodirectory – wp business directory plugin and classified listings directory <= 2.8.181
Original advisory text
GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., &lt;img src=x onerror=alert(1)&gt;) to bypass the strpos()-gated tag-stripping check.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Sep 2026
Updated29 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-93897 · NVD
CVE-2026-93897 · MITRE
Track software like this
Free during beta