{"id":"CVE-2026-110703","kind":"vulnerability","aliases":["CVE-2026-110703"],"related":[],"title":"GeoDirectory WordPress plugin: stored XSS via listing post content","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.","summary":"Versions up to and including 2.8.191 of the GeoDirectory WordPress plugin do not sanitize or escape the post_content parameter, so injected script is stored and runs when any user opens the page. An authenticated subscriber who owns a published listing can edit it and have the payload go live without moderation.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-subscriber-registration","plugin-updated"],"how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen or with `wp plugin get geodirectory --field=version`\n- Compare the result against `2.8.191`; a version at or below it is exposed","fix":"- Update the GeoDirectory plugin to a version later than `2.8.191` (the sources do not name the exact fixed release)\n- Until updated, review subscriber-owned published listings for injected script tags","status":"open","published_at":"2026-10-16T10:18:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:41+00:00","updated_at":"2026-10-25T03:59:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:59:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GeoDirectory plugin to a version later than `2.8.191` (the sources do not name the exact fixed release)\n- Until updated, review subscriber-owned published listings for injected script tags","reach":"internet","title":"GeoDirectory WordPress plugin: stored XSS via listing post content","impact":"medium","summary":"Versions up to and including 2.8.191 of the GeoDirectory WordPress plugin do not sanitize or escape the post_content parameter, so injected script is stored and runs when any user opens the page. An authenticated subscriber who owns a published listing can edit it and have the payload go live without moderation.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","geodirectory","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Confirm the fixed plugin version and whether the default configuration allows subscriber registration; check the NVD entry and the plugin changelog.","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin Plugins screen or with `wp plugin get geodirectory --field=version`\n- Compare the result against `2.8.191`; a version at or below it is exposed","needs_analyst":true,"not_affected_if":["plugin-updated","no-subscriber-registration"],"who_is_affected":"Sites running the GeoDirectory plugin at version 2.8.191 or earlier where subscriber-level users can create or edit listings. The risk is highest when site visitors can register as subscribers and listing content is rendered to other users, including admins. Sites without this plugin, or with it updated, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":3480,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110703':12A,15A '-2026':11A,14A '2.8.191':30B,110C 'access':130C,146C 'ajax':177C 'alreadi':191C 'already-publish':190C 'appli':182C 'arbitrari':135C 'attack':125C,153C 'authent':59B,124C 'busi':80C 'bypass':194C 'check':162C 'classifi':84C 'content':9A,43B,101C 'cross':95C 'cross-sit':94C 'cve':10A,13A 'data':166C 'directori':81C,86C 'due':111C 'edit':67B,168C,187C 'escap':40B,118C 'execut':142C 'exist':184C 'geodir':164C 'geodirectori':1A,16B,33B,78C 'go':73B 'host':20B 'howev':175C 'immedi':201C 'includ':29B,109C 'inject':46B,134C,148C 'input':114C 'insuffici':113C 'level':129C 'limit':169C 'list':7A,65B,85C,158C,193C 'live':74B,200C 'make':120C 'moder':76B,197C 'open':55B 'output':117C 'own':62B 'ownership':161C 'packag':17B 'page':57B,139C,149C 'paramet':44B,102C 'payload':72B,174C 'plugin':3A,24B,35B,82C,87C 'possibl':122C 'post':8A,42B,100C,165C,179C,185C 'publish':64B,157C,192C 're':181C,196C 're-appli':180C 're-moder':195C 'remain':199C 'requir':151C 'run':51B 'sanit':38B,115C 'save':178C 'script':47B,97C,137C 'self':19B 'self-host':18B 'site':96C 'status':186C 'store':4A,49B,93C,172C 'subscrib':60B,128C 'subscriber-level':127C 'user':54B,145C 'version':25B,105C 'via':6A,98C 'vulner':91C 'web':136C 'whenev':143C 'without':75B 'wordpress':2A,21B,23B,34B,89C 'wordpress-plugin':22B 'wp':79C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory plugin at version 2.8.191 or earlier where subscriber-level users can create or edit listings. The risk is highest when site visitors can register as subscribers and listing content is rendered to other users, including admins. Sites without this plugin, or with it updated, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T10:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110703","severity":null,"published_at":"2026-10-16T10:18:05+00:00","modified_at":"2026-10-16T14:51:17+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}