CVE-2026-96766: GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it, provided they own a GeoDirectory listing. The vulnerable AJAX save handler checks post authorship and a nonce but does not enforce an additional capability check.
What must an attacker do to trigger the stored script?
The attacker must submit malicious script content through the business_hours parameter while saving a listing they own. The script executes when another user accesses the page containing the injected listing.
Are sites affected by default?
The issue affects GeoDirectory versions through 2.8.183 when an authenticated Subscriber-level or higher user can create or own a listing and save its business-hours data. Exploitation does not require user interaction from the attacker, but a user must visit the injected page for the stored script to execute.
How can administrators reduce exposure before updating?
Restrict untrusted users from obtaining Subscriber-level or higher authenticated access and from creating or owning GeoDirectory listings. Review listing business-hours content for injected script before users visit affected listing pages.