CVE-2026-124250: WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress GeoDirectory pluginto a version that resolves this vulnerability.Fixed in 2.8.203
Event History
Frequently Asked Questions
Which GeoDirectory versions are affected?
The issue affects GeoDirectory versions through 2.8.202. The available data does not identify a fixed version.
What does an attacker need to exploit this issue?
The vulnerability is network-accessible, requires no privileges, and has low attack complexity. Exploitation requires user interaction, consistent with reflected XSS.
What impact could successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The scope may extend beyond the vulnerable component.