CVE-2026-111069: GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Subscriber-level access or higher and must be able to submit or own a listing containing the twitterusername custom field. The issue does not require victim interaction from the attacker beyond a user later viewing the injected page.

Q: Are installations running version 2.8.192 affected?

Yes. The affected range includes all GeoDirectory versions up to and including 2.8.192.

Q: What is required for the injected script to execute?

The malicious value is stored in the twitterusername custom field and executes when another user accesses a page where the injected value is rendered. The browser-side alphanumeric pattern does not prevent exploitation because equivalent validation is not enforced server-side.

Q: How can administrators check for possible exploitation?

Review values stored for the twitterusername custom field, particularly on listings owned by low-privileged users, for unexpected characters or HTML attribute-breakout and script payloads. Investigate affected listing pages that may render those stored values.

Published Oct 16, 2026

Updated

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.

Affected Software

1 affected component

GeoDirectory GeoDirectory<=2.8.192

Event History

Oct 16, 2026

CVE Published

via MITRE·06:41 AM

Data Sourced

via MITRE·06:41 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Subscriber-level access or higher and must be able to submit or own a listing containing the twitterusername custom field. The issue does not require victim interaction from the attacker beyond a user later viewing the injected page.

Are installations running version 2.8.192 affected?

Yes. The affected range includes all GeoDirectory versions up to and including 2.8.192.

What is required for the injected script to execute?

The malicious value is stored in the twitterusername custom field and executes when another user accesses a page where the injected value is rendered. The browser-side alphanumeric pattern does not prevent exploitation because equivalent validation is not enforced server-side.

How can administrators check for possible exploitation?

Review values stored for the twitterusername custom field, particularly on listings owned by low-privileged users, for unexpected characters or HTML attribute-breakout and script payloads. Investigate affected listing pages that may render those stored values.

CVE-2026-111069: GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations running version 2.8.192 affected?

What is required for the injected script to execute?

How can administrators check for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations running version 2.8.192 affected?

What is required for the injected script to execute?

How can administrators check for possible exploitation?