CVE-2026-113674

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674

The GeoDirectory WordPress plugin (versions prior to 2.8.194 ) contains an improper access control vulnerability (CWE-284 ) where it fails to properly verify ownership of listings submitted by logged-out users. When guest posting is enabled, unauthenticated attackers can modify, unpublish, attach...

EUVD-2026-109217

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

WordPress GeoDirectory plugin < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification vulnerability

Unauthenticated Guest-Submitted Listing Modification vulnerability discovered by Vincent Suen GreenHat Security in WordPress Plugin GeoDirectory versions 2.8.194...

PT-2026-122508

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting i...

CVE-2026-1656

The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email...

CVE-2026-1656

CVE-2026-1656 concerns the WordPress Business Directory Plugin (versions up to and including 6.4.20). The root cause is a missing authorization check in the wpbdp_ajax action, enabling unauthenticated attackers to bypass controls and modify arbitrary listings (titles, content, email addresses) by...

CVE-2026-1656 Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification

The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email...

CVE-2026-1656 Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification

The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email...

WordPress Business Directory Plugin plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Listing Modification vulnerability discovered by Sein Linn in WordPress Plugin Business Directory versions = 6.4.20...

PT-2026-20363

The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email...

WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...