CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...

CVE-2026-110703

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-102831

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-111069

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This...

EUVD-2026-102788

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This...

PT-2026-115497

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.193 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticat...

CVE-2026-107754

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages fileinfo2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

CVE-2026-107650

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-100910

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-100899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages fileinfo2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

CVE-2026-107754

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.8.190 . The root cause is insufficient input sanitization and output escaping within the post_images (file_i...

PT-2026-113716

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-113718

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post images file info2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

CVE-2026-96563

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-96292

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-96563

The Motors – Car Dealership & Classified Listings plugin for WordPress (versions up to and including 1.4.123 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the 'stm_f_s' parameter. This flaw allows authenticat...

EUVD-2026-96104

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

EUVD-2026-96054

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104993: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104899: Improper Control of Filename for Include/Require Statement in PHP Program

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...