---
id: "CVE-2026-124250"
page: "https://infrastack.ai/live/CVE-2026-124250"
kind: "vulnerability"
aliases: ["CVE-2026-124250"]
title: "GeoDirectory WordPress plugin: reflected XSS lets attackers run scripts in browsers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "geodirectory", "fixed": ["2.8.203"], "affected": "<= 2.8.202", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["geodirectory", "package", "reflected-xss", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T10:16:43+00:00"
first_seen_at: "2026-11-11T10:26:48+00:00"
updated_at: "2026-11-11T10:27:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124250", "first_seen_at": "2026-11-11T10:26:48+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2725/", "first_seen_at": "2026-11-11T10:27:57+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2725/", "https://wpgeodirectory.com/change-logs/"]}]
exploit_sources: []
---

# GeoDirectory WordPress plugin: reflected XSS lets attackers run scripts in browsers

Link for people: https://infrastack.ai/live/CVE-2026-124250 (this .md is for agents)

GeoDirectory (AyeCode) for WordPress has an unauthenticated reflected XSS in versions up to and including 2.8.202. The 'country', 'region', 'city' and 'neighbourhood' query parameters are inserted unescaped into location replacement variables (e.g. %%location_single%%) used in page titles, meta titles and category descriptions. An attacker needs a user to click a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:geodirectory affected <= 2.8.202 fixed 2.8.203

## How to check

In WordPress admin > Plugins, check the GeoDirectory version (or the Version header in wp-content/plugins/geodirectory/geodirectory.php). Anything at or below 2.8.202 is affected. wp plugin list | grep geodirectory also works.

## Fix

Update GeoDirectory to 2.8.203 or later (per WPSec; not yet confirmed on the vendor changelog).

## Timeline

- 2026-11-11T10:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124250
- 2026-11-11T10:27:57+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2725/ — WPSec advisory WPSEC-2026-2725 (third party) gives params country/region/city/neighbourhood, fix 2.8.203 (2026-11-06). Vendor changelog I could read stops at 2.8.202 and wordpress.org/svn did not load, so nothing verified; fix is from WPSec only. NVD page not fetchable.

## Documents

- [advisory] WPSEC-2026-2725: GeoDirectory <= 2.8.202 Unauthenticated Reflected XSS via Location Replacement Variables https://wpsec.com/vuln/WPSEC-2026-2725/
- [mentions] GeoDirectory Changelog (vendor) https://wpgeodirectory.com/change-logs/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_