CVE-2026-68565: WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability
Published Aug 18, 2026
·Updated
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
Affected Software
1 affected component
WordPress GeoDirectory plugin<=2.8.172
Event History
Aug 18, 2026
CVE Published
via MITRE·01:59 PM
Data Sourced
via MITRE·01:59 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed, and what access does an attacker need?
Sites using GeoDirectory version 2.8.172 or earlier are in scope. Exploitation requires an authenticated WordPress account with Contributor-level privileges.
2
What are the practical exploitation conditions and potential impact?
The vector is network-accessible, requires low attack complexity, and requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability beyond the vulnerable component's security scope.