CVE-2026-66604

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66604 WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66604

An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...

CVE-2026-68565

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-68565 WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

EUVD-2026-60934

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-68565

Contributor-level XSS in the WordPress GeoDirectory plugin affects versions up to 2.8.172 (CVE description) or 2.8.174 (Patchstack report), exploitable by authenticated users with contributor privileges to inject scripts affecting other users. No patch version or in-the-wild exploitation details ...

CVE-2026-68565

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

WordPress GeoDirectory plugin <= 2.8.177 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GeoDirectory versions = 2.8.177...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

EUVD-2026-56929

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091

The GeoDirectory WordPress plugin (GeoDirectory – WP Business Directory Plugin and Classified Listings Directory)

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...

PT-2026-70888

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988

The available details confirm CVE-2026-16988 affects the GeoDirectory WordPress plugin (versions before 2.8.169). The root cause is an missing authorization check when returning map marker data for a single listing via the markers REST endpoint, allowing unauthenticated users to disclose the titl...