CVE-2026-93897: GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodirsavepost endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. They must be able to submit a GeoDirectory listing or other content that reaches the geodir_save_post AJAX endpoint.
What input is required to trigger the vulnerability?
The attacker must place a script payload in a text-type GeoDirectory custom field, such as a phone field. The payload uses entity-encoded angle brackets, for example <img src=x onerror=alert(1)>, to bypass the tag-stripping check.
Who is affected when a malicious payload has been stored?
The injected script executes in the browser of any user who accesses the page containing the affected GeoDirectory content. The impact includes exposure of information and integrity effects in the context of the viewing user.
How can administrators check for possible exploitation?
Review GeoDirectory content submitted through the geodir_save_post endpoint, especially text-type custom fields such as phone fields. Look for entity-encoded HTML-like values, including encoded angle brackets such as < and >, that could decode into script-capable markup.