WordPress GeoDirectory plugin < 2.8.196 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.196...

WordPress GeoDirectory plugin < 2.8.194 - Subscriber+ Media File Disclosure and Deletion vulnerability

Subscriber+ Media File Disclosure and Deletion vulnerability discovered by vuxvinh in WordPress Plugin GeoDirectory versions 2.8.194...

WordPress GeoDirectory plugin < 2.8.194 - Unauthenticated Non-Public Listing Disclosure vulnerability

Unauthenticated Non-Public Listing Disclosure vulnerability discovered by Jacek Sowiński in WordPress Plugin GeoDirectory versions 2.8.194...

WordPress GeoDirectory plugin < 2.8.194 - Unauthenticated Non-Public Listing Disclosure vulnerability

Unauthenticated Non-Public Listing Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.194...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin GeoDirectory versions = 2.8.191...

WordPress GeoDirectory plugin <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability discovered by OKISO - OKISO in WordPress Plugin GeoDirectory versions = 2.8.192...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.192 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of the twitterusername parameter input and insufficient output escaping. Additionally, the client-side HTML pattern attribute restrictions are not validat...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.191 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postcontent' parameter, allowing storage-type cross-site scripting attacks. Authentication attackers with...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin GeoDirectory versions = 2.8.190...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin GeoDirectory versions = 2.8.190...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.190 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Certified attackers with subscription-level or higher permissions can inject any web script into pages through the...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.187 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin GeoDirectory versions = 2.8.187...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tai Ha superx in WordPress Plugin GeoDirectory versions = 2.8.188...

WordPress GeoDirectory code injection vulnerability

WordPress GeoDirectory 2.8.187 and earlier versions have a code injection vulnerability. This vulnerability stems from the designtype parameter, which involves local file inclusion. It may allow unauthenticated attackers to include and execute any.php file on the server, thereby bypassing access...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in GeoDirectory = 2.8.161 versions...

CVE-2024-56259 WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.3.84...

CVE-2024-56259 WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through = 2.3.84...

WordPress GeoDirectory Plugin <= 2.3.80 is vulnerable to Cross Site Scripting (XSS)

Software GeoDirectory Type Plugin Vulnerable versions = 2.3.80 Fixed in 2.3.81 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50437 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4d145dfd1bc3 Credits João Pedro S Alcântara Kinorth Required...