292 matches found
CVE-2026-16968 GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...
CVE-2026-16968: Exposure of Sensitive Information to an Unauthorized Actor
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...
CVE-2025-15677: Improper Neutralization of Input During Web Page Generation
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
PT-2026-67968
Name of the Vulnerable Software and Affected Versions GeoDirectory WordPress plugin versions prior to 2.8.110 Description Insufficient sanitization and escaping of a place-category setting before it is output on an admin page allows high-privilege users, such as editors and above, to execute Stor...
CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...
CVE-2026-57681
The CVE describes a Server Side Request Forgery (SSRF) vulnerability in the WordPress GeoDirectory plugin for WordPress, specifically version
EUVD-2026-41290
Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...
CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...
CVE-2026-57681
Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...
CVE-2026-57681: Server-Side Request Forgery (SSRF)
Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...
WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by dodoh4t in WordPress Plugin GeoDirectory versions = 2.8.161...
CVE-2026-54831
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...
CVE-2026-54831
CVE-2026-54831 affects WordPress GeoDirectory plugin versions 2.8.162 and earlier. It describes an unauthenticated SQL injection vulnerability in GeoDirectory, with CVSS 3.1 indicating network access, no user interaction, high confidentiality impact, and critical overall severity. The provided do...
CVE-2026-54831 WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...
CVE-2026-54831 WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...
EUVD-2026-39675
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...
PT-2026-52730
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...
CVE-2026-54831: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in GeoDirectory = 2.8.162 versions...