GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities

Product

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

by paoltaia · last CVE Oct 31, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities17 In the news0 Timeline

Severity mix

Critical 0High 4Medium 13Low 0

Severity

All severities17 Critical0 High4 Medium13 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-118635 New	6.5	0%	Oct 30	GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter Affected: through 2.8.198
CVE-2026-116752 New	6.4	0%	Oct 31	GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection Affected: through 2.8.197
CVE-2026-119113 New	6.4	0%	Oct 30	GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter Affected: through 2.8.199
CVE-2026-110703	6.4	0%	Oct 16	GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute Affected: through 2.8.191
CVE-2026-111069	6.4	0%	Oct 16	GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field Affected: through 2.8.192
CVE-2026-107650	6.4	0%	Oct 14	GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title Affected: through 2.8.190
CVE-2026-107754	6.4	0%	Oct 14	GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title Affected: through 2.8.190
CVE-2026-104993	6.4	0%	Oct 10	GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field Affected: through 2.8.188
CVE-2026-96766	6.4	0%	Sep 25	GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter Affected: through 2.8.183
CVE-2026-93897	6.4	0%	Sep 25	GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') Affected: through 2.8.181
CVE-2024-13506	6.4	0%	Feb 11	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter Affected: through 2.8.97
CVE-2024-3732	5.4	0%	Apr 23	GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode Affected: through 2.3.48
CVE-2025-12833	4.3	0%	Nov 12	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment Affected: through 2.8.139