Advisories · Technology

paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory.

Every CVE that names paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-116752 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 31 Oct 2026
CVE-2026-119113 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-118635 CVE record

CVSS 6.5 Medium

GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Code injection
Not analysed yet 30 Oct 2026
CVE-2026-110703 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2026
CVE-2026-111069 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2026
CVE-2026-107650 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-107754 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-104899 CVE record

CVSS 8.1 High

GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-104993 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-103913 CVE record

CVSS 7.5 High

GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- SQL injection
Not analysed yet 3 Oct 2026
CVE-2026-96766 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-93897 CVE record

CVSS 6.4 Medium

GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-19091 CVE record

CVSS 8.1 High

GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Path traversal
Not analysed yet 11 Aug 2026
CVE-2025-12833 CVE record

CVSS 4.3 Medium

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Broken access control
Not analysed yet 12 Nov 2025
CVE-2024-13507 CVE record

CVSS 7.5 High

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- SQL injection
Not analysed yet 26 Jul 2025
CVE-2024-13506 CVE record

CVSS 6.4 Medium

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2025
CVE-2024-3732 CVE record

CVSS 6.4 Medium

GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
Not analysed yet 23 Apr 2024