Live › vulnerability › CVE-2026-116752
The GeoDirectory WordPress plugin, all versions up to and including 2.8.197, does not sanitize the 'post_images' parameter, enabling stored cross-site scripting. An authenticated subscriber can plant a script that runs in the browser of an administrator or editor who opens the pending listing's edit screen.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 10:34 UTC. All times on this page are UTC.
Sites running the GeoDirectory plugin up to and including 2.8.197 that allow subscriber-level accounts, where editors or administrators review pending listings. Sites without this plugin or with a newer version are not affected. The sources do not say whether non-default settings are required.
No product ranges from the sources yet.
wp plugin get geodirectory --field=version2.8.197 or earlier as exposed2.8.197; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.
This page as .md · .json · in your agent: get_signal("CVE-2026-116752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.