CVE-2026-110703: GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDirPostData::canedit() limits who can store the payload; however, because ajaxsavepost() re-applies the existing poststatus, edits to an already-published listing bypass re-moderation and remain live immediately.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Subscriber-level access or higher can exploit it, but they must own a listing that is already published. The ownership check restricts payload storage to the owner of the listing.
Does an attacker need a moderator to approve the malicious edit?
No. When the owner edits an already-published listing, the AJAX save process reapplies its existing published status, so the modified listing remains live without re-moderation.
What is the impact on visitors?
Scripts injected into a vulnerable listing can execute in the browser of any user who accesses the injected page. The disclosed impact includes loss of confidentiality and integrity, with no availability impact stated.
Which versions are affected?
All GeoDirectory versions up to and including 2.8.191 are affected according to the provided information.