{"id":"CVE-2026-125805","kind":"vulnerability","aliases":["CVE-2026-125805"],"related":[],"title":"GeoDirectory WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.8.204.","summary":"AyeCode's GeoDirectory plugin for WordPress has a stored cross-site scripting flaw in versions up to 2.8.204. An attacker who can submit content can plant script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geodirectory","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed GeoDirectory version in the WordPress admin plugin list, or the `Version` header in `geodirectory/geodirectory.php`\n- Confirm whether the installed version is `2.8.204` or earlier","fix":"- GeoDirectory: a version later than `2.8.204` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:41+00:00","updated_at":"2026-11-15T14:37:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T14:37:41Z","model":"claude-haiku-5-5","output":{"fix":"- GeoDirectory: a version later than `2.8.204` (the sources do not name the exact fixed release)","reach":"internet","title":"GeoDirectory WordPress plugin: stored XSS through input handling","impact":"medium","summary":"AyeCode's GeoDirectory plugin for WordPress has a stored cross-site scripting flaw in versions up to 2.8.204. An attacker who can submit content can plant script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","geodirectory","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in other visitors' browsers, possibly stealing sessions","analyst_note":"Confirm the first fixed GeoDirectory release and whether the flaw needs a logged-in submitter, from the vendor advisory or the NVD entry.","how_to_check":"- Check the installed GeoDirectory version in the WordPress admin plugin list, or the `Version` header in `geodirectory/geodirectory.php`\n- Confirm whether the installed version is `2.8.204` or earlier\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the GeoDirectory plugin for WordPress at version 2.8.204 or earlier are affected. Sites without GeoDirectory installed can skip it; the sources do not describe any other configuration that changes exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4555,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125805':11A,14A '-2026':10A,13A '2.8.204':39B,82C 'affect':77C 'allow':73C 'attack':41B 'ayecod':21B,69C 'browser':54B 'content':45B 'cross':31B,64C 'cross-sit':30B,63C 'cve':9A,12A 'flaw':34B 'generat':62C 'geodirectori':1A,15B,23B,71C,72C,78C 'handl':8A 'host':19B 'improp':55C 'input':7A,58C 'issu':76C 'ltd':70C 'n/a':80C 'neutral':56C 'packag':16B 'page':61C 'plant':47B 'plugin':3A,24B 'run':50B 'script':33B,48B,66C 'self':18B 'self-host':17B 'site':32B,65C 'store':4A,29B,74C 'submit':44B 'version':36B 'visitor':53B 'vulner':67C 'web':60C 'wordpress':2A,20B,26B 'xss':5A 'xss.this':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GeoDirectory plugin for WordPress at version 2.8.204 or earlier are affected. Sites without GeoDirectory installed can skip it; the sources do not describe any other configuration that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["geodirectory","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125805':11A,14A '-2026':10A,13A 'cve':9A,12A 'geodirectori':1A 'handl':8A 'input':7A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'2.8.204':39B 'attack':41B 'ayecod':21B 'browser':54B 'content':45B 'cross':31B 'cross-sit':30B 'flaw':34B 'geodirectori':15B,23B 'host':19B 'packag':16B 'plant':47B 'plugin':24B 'run':50B 'script':33B,48B 'self':18B 'self-host':17B 'site':32B 'store':29B 'submit':44B 'version':36B 'visitor':53B 'wordpress':20B,26B","search_c":"'2.8.204':82C 'affect':77C 'allow':73C 'ayecod':69C 'cross':64C 'cross-sit':63C 'generat':62C 'geodirectori':71C,72C,78C 'improp':55C 'input':58C 'issu':76C 'ltd':70C 'n/a':80C 'neutral':56C 'page':61C 'script':66C 'site':65C 'store':74C 'vulner':67C 'web':60C 'xss.this':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125805","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}