Medium severity · published Oct 30, 2026
CVE-2026-118635
GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
New
6.5
CVSS
–
EPSS
No
On KEV
Description
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GW
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · paoltaia
through 2.8.198 · source: vendor
Affected product
GW
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
paoltaia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118635
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/613531ba-0dbb-4c2d-9c40-e11f31cf4575?source=cve
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L2044
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L2005
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L1171
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/class-geodir-ajax.php#L1482
github.com
https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip
More from GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
8.1
CVE-2026-104899
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
8.1
CVE-2026-19091
GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
7.5
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
7.5
CVE-2024-13507
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection
6.4
CVE-2026-119113
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter