GEODIRECTORY · CVE-2026-124250 · Package
FIX → 2.8.203
GeoDirectory (AyeCode) for WordPress has an unauthenticated reflected XSS in versions up to and including 2.8.202. The 'country', 'region', 'city' and 'neighbourhood' query parameters are inserted unescaped into location replacement variables (e.g. %%location_single%%) used in page titles, meta titles and category descriptions. An attacker needs a user to click a crafted link.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites running the GeoDirectory plugin at 2.8.202 or earlier whose directory pages use location variables in titles, meta titles or category descriptions. Visitors, and admins if they click a crafted link, are the targets; no login is needed by the attacker. Sites not running GeoDirectory can skip it.
Not affected if plugin-not-installed
Who cares geodirectory, reflected-xss, wordpress, wordpress-plugin, xss
2.8.202 is affected. wp plugin list | grep geodirectory also worksUpgrade to 2.8.203
Update GeoDirectory to 2.8.203 or later (per WPSec; not yet confirmed on the vendor changelog).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.