CVE-2026-114270: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

CVE-2026-113494: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft,...

CVE-2026-113487: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

PT-2026-67968

Name of the Vulnerable Software and Affected Versions GeoDirectory WordPress plugin versions prior to 2.8.110 Description Insufficient sanitization and escaping of a place-category setting before it is output on an admin page allows high-privilege users, such as editors and above, to execute Stor...

EUVD-2023-12357

Malicious code in bioql PyPI...

PT-2025-29209 · WordPress · Geodirectory

Name of the Vulnerable Software and Affected Versions: GeoDirectory WordPress plugin versions prior to 2.8.120 Description: The GeoDirectory WordPress plugin does not validate or escape certain shortcode attributes before displaying them within a page or post. This could allow users with...

CVE-2022-4775

The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...

PT-2023-16136

Name of the Vulnerable Software and Affected Versions GeoDirectory WordPress plugin versions prior to 2.2.24 Description The issue arises from the improper sanitization and escaping of a parameter before its use in a SQL statement, leading to a SQL injection. This can be exploited by high privile...

CVE-2022-4775

The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...

CVE-2022-4775

The GeoDirectory WordPress plugin prior to version 2.2.22 is affected by a Stored XSS vulnerability caused by not validating/escaping certain shortcode attributes before output. This could allow a user with as little as Contributor privileges to inject payloads that impact higher-privilege users ...