CVE-2026-96766: GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

Published Sep 25, 2026
·
Updated

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.

Affected Software

1 affected component
GeoDirectory GeoDirectory WP Business Directory Plugin and Classified Listings Directory<=2.8.183

Event History

Sep 25, 2026
CVE Published
via MITRE·06:39 AM
Data Sourced
via MITRE·06:39 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An authenticated WordPress user with Subscriber-level access or higher can exploit it, provided they own a GeoDirectory listing. The vulnerable AJAX save handler checks post authorship and a nonce but does not enforce an additional capability check.

2

What must an attacker do to trigger the stored script?

The attacker must submit malicious script content through the business_hours parameter while saving a listing they own. The script executes when another user accesses the page containing the injected listing.

3

Are sites affected by default?

The issue affects GeoDirectory versions through 2.8.183 when an authenticated Subscriber-level or higher user can create or own a listing and save its business-hours data. Exploitation does not require user interaction from the attacker, but a user must visit the injected page for the stored script to execute.

4

How can administrators reduce exposure before updating?

Restrict untrusted users from obtaining Subscriber-level or higher authenticated access and from creating or owning GeoDirectory listings. Review listing business-hours content for injected script before users visit affected listing pages.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203