{"id":"CVE-2026-124250","kind":"vulnerability","aliases":["CVE-2026-124250"],"related":[],"title":"GeoDirectory WordPress plugin: reflected XSS lets attackers run scripts in browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.","summary":"GeoDirectory (AyeCode) for WordPress has an unauthenticated reflected XSS in versions up to and including 2.8.202. The 'country', 'region', 'city' and 'neighbourhood' query parameters are inserted unescaped into location replacement variables (e.g. %%location_single%%) used in page titles, meta titles and category descriptions. An attacker needs a user to click a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"geodirectory","fixed":["2.8.203"],"affected":"<= 2.8.202","ecosystem":"wordpress"}],"ecosystems":[],"tags":["geodirectory","package","reflected-xss","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the GeoDirectory version (or the Version header in wp-content/plugins/geodirectory/geodirectory.php). Anything at or below 2.8.202 is affected. wp plugin list | grep geodirectory also works.","fix":"Update GeoDirectory to 2.8.203 or later (per WPSec; not yet confirmed on the vendor changelog).","status":"open","published_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","triaged_at":"2026-11-11T10:27:00+00:00","updated_at":"2026-11-11T10:27:57+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-11T10:27:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GeoDirectory WordPress plugin: reflected XSS lets attackers run scripts in browsers","impact":"medium","summary":"AyeCode's GeoDirectory plugin for WordPress has a reflected cross-site scripting flaw, affecting versions up to and including 2.8.202. An attacker who tricks a user into opening a crafted link can run script in that user's browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in victim's browser session on the site","analyst_note":"Confirm the fixed version and the affected parameters from the AyeCode or WPScan advisory; the NVD entry gives no fix version.","how_to_check":"- Check the installed GeoDirectory plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version at or below `2.8.202` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the GeoDirectory plugin for WordPress at version 2.8.202 or earlier are exposed, since the flaw is in how the plugin reflects input into pages. The sources do not state which pages or parameters are involved, or whether a logged-in user is required to trigger it. Sites without GeoDirectory installed are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4555,"output_tokens":562,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the affected parameters from the AyeCode or WPScan advisory; the NVD entry gives no fix version.","search":"'-124250':14A,17A '-2026':13A,16A '2.8.202':44B,109C 'affect':104C 'allow':100C 'attack':7A,73B 'ayecod':30B,96C 'browser':11A 'categori':70B 'citi':48B 'click':78B 'countri':46B 'craft':80B 'cross':91C 'cross-sit':90C 'cve':12A,15A 'descript':71B 'e.g':60B 'generat':89C 'geodirectori':1A,19B,29B,98C,99C,105C 'geodirectory':18A 'improp':82C 'includ':43B 'input':85C 'insert':54B 'issu':103C 'let':6A 'link':81B 'locat':57B,61B 'ltd':97C 'meta':67B 'n/a':107C 'need':74B 'neighbourhood':50B 'neutral':83C 'packag':20B 'page':65B,88C 'paramet':52B 'plugin':3A,27B 'queri':51B 'reflect':4A,22B,36B,101C 'reflected-xss':21B 'region':47B 'replac':58B 'run':8A 'script':9A,93C 'singl':62B 'site':92C 'titl':66B,68B 'unauthent':35B 'unescap':55B 'use':63B 'user':76B 'variabl':59B 'version':39B 'vulner':94C 'web':87C 'wordpress':2A,24B,26B,32B 'wordpress-plugin':25B 'xss':5A,23B,28B,37B 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the GeoDirectory plugin at 2.8.202 or earlier whose directory pages use location variables in titles, meta titles or category descriptions. Visitors, and admins if they click a crafted link, are the targets; no login is needed by the attacker. Sites not running GeoDirectory can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["geodirectory"],"ptokens":["geodirectory"],"labels":["geodirectory","high","package","reflectedxss","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-124250':14A,17A '-2026':13A,16A 'attack':7A 'browser':11A 'cve':12A,15A 'geodirectori':1A 'geodirectory':18A 'let':6A 'plugin':3A 'reflect':4A 'run':8A 'script':9A 'wordpress':2A 'xss':5A","search_b":"'2.8.202':44B 'attack':73B 'ayecod':30B 'categori':70B 'citi':48B 'click':78B 'countri':46B 'craft':80B 'descript':71B 'e.g':60B 'geodirectori':19B,29B 'includ':43B 'insert':54B 'link':81B 'locat':57B,61B 'meta':67B 'need':74B 'neighbourhood':50B 'packag':20B 'page':65B 'paramet':52B 'plugin':27B 'queri':51B 'reflect':22B,36B 'reflected-xss':21B 'region':47B 'replac':58B 'singl':62B 'titl':66B,68B 'unauthent':35B 'unescap':55B 'use':63B 'user':76B 'variabl':59B 'version':39B 'wordpress':24B,26B,32B 'wordpress-plugin':25B 'xss':23B,28B,37B","search_c":"'2.8.202':109C 'affect':104C 'allow':100C 'ayecod':96C 'cross':91C 'cross-sit':90C 'generat':89C 'geodirectori':98C,99C,105C 'improp':82C 'input':85C 'issu':103C 'ltd':97C 'n/a':107C 'neutral':83C 'page':88C 'reflect':101C 'script':93C 'site':92C 'vulner':94C 'web':87C 'xss.this':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T10:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124250","severity":null,"published_at":"2026-11-11T10:16:43+00:00","modified_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","fetched_at":"2026-11-11T10:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124250:3535","url":"https://wpsec.com/vuln/WPSEC-2026-2725/","severity":null,"published_at":"2026-11-11T10:27:57+00:00","modified_at":"2026-11-11T10:27:57+00:00","first_seen_at":"2026-11-11T10:27:57+00:00","fetched_at":"2026-11-11T10:27:57+00:00","note":"WPSec advisory WPSEC-2026-2725 (third party) gives params country/region/city/neighbourhood, fix 2.8.203 (2026-11-06). Vendor changelog I could read stops at 2.8.202 and wordpress.org/svn did not load, so nothing verified; fix is from WPSec only. NVD page not fetchable.","cites":["https://wpsec.com/vuln/WPSEC-2026-2725/","https://wpgeodirectory.com/change-logs/"]}],"documents":[{"id":124711,"url":"https://wpsec.com/vuln/WPSEC-2026-2725/","title":"WPSEC-2026-2725: GeoDirectory <= 2.8.202 Unauthenticated Reflected XSS via Location Replacement Variables","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":92524,"url":"https://wpgeodirectory.com/change-logs/","title":"GeoDirectory Changelog (vendor)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}