GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities

Product

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

by paoltaia · last CVE Oct 31, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Severity mix

Critical 0High 4Medium 13Low 0

Severity

Exploitation

Watch

Add GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-104899	8.1	1%	Oct 10	GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter Affected: through 2.8.187
CVE-2026-19091	8.1	1%	Aug 11	GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision Affected: through 2.8.169
CVE-2026-103913	7.5	0%	Oct 3	GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing Affected: through 2.8.186
CVE-2024-13507	7.5	1%	Jul 26	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection Affected: through 2.8.97