Geodirectory Vulnerabilities

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.8.173. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

CVSS:

7.2

Affected:

up to 2.8.173

Fixed in:

2.8.174

Disclosed:

Aug 19, 2026

CVE-2026-66604 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.8.177. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 2.8.177

Fixed in:

2.8.178

Disclosed:

Aug 18, 2026

CVE-2026-68565 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with...

CVSS:

8.1

Affected:

up to 2.8.169

Fixed in:

2.8.170

Disclosed:

Aug 11, 2026

CVE-2026-19091 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.168. This is due to missing ownership verification before including non-public post statuses (pending, draft) in the markers REST endpoint query, allowing unauthenticated requests to retrieve mark...

CVSS:

5.3

Affected:

up to 2.8.168

Fixed in:

2.8.169

Disclosed:

Aug 3, 2026

CVE-2026-16988 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.109 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

4.4

Affected:

up to 2.8.109

Fixed in:

2.8.110

Disclosed:

Jul 28, 2026

CVE-2025-15677 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.167. This is due to missing capability check before including user email addresses in the geodir_json_search_users AJAX response. This makes it possible for authenticated attackers, with contribut...

CVSS:

4.3

Affected:

up to 2.8.167

Fixed in:

2.8.168

Disclosed:

Jul 27, 2026

CVE-2026-16968 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.161. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary...

CVSS:

6.4

Affected:

up to 2.8.161

Fixed in:

2.8.162

Disclosed:

Jun 30, 2026

CVE-2026-57681 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.162 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

7.5

Affected:

up to 2.8.162

Fixed in:

2.8.163

Disclosed:

Jun 17, 2026

CVE-2026-54831 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.8.157. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.8.157

Fixed in:

2.8.158

Disclosed:

May 13, 2026

CVE-2026-42671 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.8.152 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

7.5

Affected:

up to 2.8.152

Fixed in:

2.8.154

Disclosed:

Apr 13, 2026

CVE-2026-39512 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.149. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can tr...

CVSS:

4.3

Affected:

up to 2.8.149

Fixed in:

2.8.150

Disclosed:

Jan 23, 2026

CVE-2026-24549 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.147.

Affected:

up to 2.8.147

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24549 on NVD →

[en] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible...

Affected:

up to 2.8.140

Fixed in:

2.8.140

Disclosed:

Nov 12, 2025

CVE-2025-12833 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible for...

CVSS:

4.3

Affected:

up to 2.8.139

Fixed in:

2.8.140

Disclosed:

Nov 11, 2025

CVE-2025-12833 on NVD →

[en] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Affected:

up to 2.8.98

Fixed in:

2.8.98

Disclosed:

Jul 26, 2025

CVE-2024-13507 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_best_of' shortcode in all versions up to, and including, 2.8.119 due to insufficient input sanitization and output escaping on user supplied attributes...

CVSS:

6.4

Affected:

up to 2.8.119

Fixed in:

2.8.120

Disclosed:

Jun 20, 2025

CVE-2025-6200 on NVD →

[en] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible...

Affected:

up to 2.8.98

Fixed in:

2.8.98

Disclosed:

Feb 11, 2025

CVE-2024-13506 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for a...

CVSS:

6.4

Affected:

up to 2.8.97

Fixed in:

2.8.98

Disclosed:

Feb 10, 2025

CVE-2024-13506 on NVD →

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist...

CVSS:

7.5

Affected:

up to 2.8.97

Fixed in:

2.8.98

Disclosed:

Jan 29, 2025

CVE-2024-13507 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.3.84.

Affected:

up to 2.3.85

Fixed in:

2.3.85

Disclosed:

Jan 2, 2025

CVE-2024-56259 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.84 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 2.3.84

Fixed in:

2.3.85

Disclosed:

Dec 30, 2024

CVE-2024-56259 on NVD →

[en] Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.

Affected:

up to 2.3.71

Fixed in:

2.3.71

Disclosed:

Nov 1, 2024

CVE-2024-43981 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AyeCode GeoDirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.3.80.

Affected:

up to 2.3.81

Fixed in:

2.3.81

Disclosed:

Oct 28, 2024

CVE-2024-50437 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 2.3.80

Fixed in:

2.3.81

Disclosed:

Oct 24, 2024

CVE-2024-50437 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the geodirectory_rated() function in versions up to, and including, 2.3.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the 'geodirectory_a...

CVSS:

4.3

Affected:

up to 2.3.70

Fixed in:

2.3.71

Disclosed:

Aug 28, 2024

CVE-2024-43981 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.

Affected:

up to 2.3.62

Fixed in:

2.3.62

Disclosed:

Aug 18, 2024

CVE-2024-43145 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the geodir_total_listings_count function in versions up to, and including, 2.3.61 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated a...

CVSS:

9.9

Affected:

up to 2.3.61

Fixed in:

2.3.62

Disclosed:

Aug 7, 2024

CVE-2024-43145 on NVD →

[en] The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attr...

Affected:

up to 2.3.49

Fixed in:

2.3.49

Disclosed:

Apr 23, 2024

CVE-2024-3732 on NVD →

The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attribute...

CVSS:

6.4

Affected:

up to 2.3.48

Fixed in:

2.3.49

Disclosed:

Apr 22, 2024

CVE-2024-3732 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Direc...

Affected:

up to 2.3.29

Fixed in:

2.3.29

Disclosed:

Dec 28, 2023

CVE-2023-50845 on NVD →

The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.3.29 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query....

CVSS:

6.6

Affected:

up to 2.3.29

Fixed in:

2.3.29

Disclosed:

Dec 21, 2023

CVE-2023-50845 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.3.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

CVSS:

7.2

Affected:

up to 2.3.28

Fixed in:

2.3.29

Disclosed:

Oct 18, 2023

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.3.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

Affected:

up to 2.3.29

Fixed in:

2.3.29

Disclosed:

Oct 18, 2023

[en] The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Affected:

up to 2.2.24

Fixed in:

2.2.24

Disclosed:

Feb 27, 2023

CVE-2023-0278 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the 'selected', 'post_type' parameters in versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for administrator-lev...

CVSS:

7.2

Affected:

up to 2.2.23

Fixed in:

2.2.24

Disclosed:

Jan 31, 2023

CVE-2023-0278 on NVD →

[en] The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as ad...

Affected:

up to 2.2.22

Fixed in:

2.2.22

Disclosed:

Jan 23, 2023

CVE-2022-4775 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and ab...

CVSS:

6.4

Affected:

up to 2.2.21

Fixed in:

2.2.22

Disclosed:

Dec 29, 2022

CVE-2022-4775 on NVD →

Update the WordPress GeoDirectory plugin to the latest available version (at least 2.2.20). Wordfence discovered and reported this CSV Injection vulnerability in WordPress GeoDirectory Plugin. This could allow a malicious actor to craft malicious formulas to then exploit vulnerabilities in the spreadsheet software or t...

Affected:

up to 2.2.20

Fixed in:

2.2.20

Disclosed:

Dec 21, 2022

The GeoDirectory plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.2.19. This allows administrator-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable con...

CVSS:

4.1

Affected:

up to 2.2.19

Fixed in:

2.2.20

Disclosed:

Dec 20, 2022

The GeoDirectory plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.2.19. This allows administrator-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable con...

Affected:

up to 2.2.20

Fixed in:

2.2.20

Disclosed:

Dec 20, 2022

[en] The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).

Affected:

up to 2.1.1.3

Fixed in:

2.1.1.3

Disclosed:

Oct 11, 2021

CVE-2021-24720 on NVD →

The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).

CVSS:

6.4

Affected:

up to 2.1.1.2

Fixed in:

2.1.1.3

Disclosed:

Sep 2, 2021

CVE-2021-24720 on NVD →

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the &lsquo;orderby&rsquo; parameter in all versions up to, and including, 2.3.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

Affected:

up to 2.3.29

Fixed in:

2.3.29