Live › vulnerability › CVE-2026-110703
Go to dashboardVersions up to and including 2.8.191 of the GeoDirectory WordPress plugin do not sanitize or escape the post_content parameter, so injected script is stored and runs when any user opens the page. An authenticated subscriber who owns a published listing can edit it and have the payload go live without moderation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin at version 2.8.191 or earlier where subscriber-level users can create or edit listings. The risk is highest when site visitors can register as subscribers and listing content is rendered to other users, including admins. Sites without this plugin, or with it updated, can skip it.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.191; a version at or below it is exposed2.8.191 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.
This page as .md · .json · in your agent: get_signal("CVE-2026-110703")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.