GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194. The source narrative identifies Contributor-level access, while the newly supplied CVSS vector specifies high privileges (PR:H); this discrepancy is unresolved, so the disclosed Contributor role is retained.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 2.8.194.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

A Subscriber can supply a crafted title in GeoDirectory's post_images data, specifically file_info[2]. The value is retained and rendered without sufficient sanitization and escaping, producing stored cross-site scripting when affected content is viewed. Published affected versions: <= 2.8.190.

A Subscriber can store a crafted GeoDirectory post_title. Insufficient sanitization and output escaping let that title execute script when affected content is viewed in the site's origin. The export does not identify the precise write endpoint or rendering function. Published affected versions: <= 2.8.190.

An unauthenticated caller can supply design_type to a PHP include path using the geodir_basic_nonce exposed in public geodir_params data. This permits local file inclusion and execution of an existing PHP file; arbitrary uploaded code requires a separate way to place it on the server. The supplied vector reports high attack complexity, and the export does not establish a universal standalone takeover. Affected versions: <= 2.8.187. The matching official changelog confirms 2.8.188 as fixed for this CVE.

A Subscriber or higher can save a script-bearing email in a ContactEmail custom field. The administrator must expose that field publicly, and the listing must be approved before viewers encounter the stored payload. The export does not identify the save endpoint or render function. Affected versions: <= 2.8.188. The matching official changelog confirms 2.8.189 as fixed for this CVE.

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post= and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The official changelog confirms the fixed release as 2.8.187.

GeoDirectory (affected: <= 2.8.183). A Subscriber who owns a listing can submit script markup in business_hours. The AJAX save handler checks only authorship and a nonce, without an additional capability restriction, and insufficient validation/escaping lets the stored value execute for later viewers. The handler's exact action name is unspecified.

GeoDirectory (affected: <= 2.8.181). A Subscriber or higher can send entity-encoded markup in a text custom field, such as phone, through geodir_save_post AJAX. Encoding bypasses the strpos()-gated tag-stripping check, leaving a stored value that executes script when later rendered. The precise output function is unspecified.

GeoDirectory through 2.8.174 allows unauthenticated attacker-controlled input to reach an unsafe database query. Exploitation can extract sensitive database contents and disrupt affected queries.

GeoDirectory is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 2.8.176.

GeoDirectory <= 2.8.173 allows an unauthenticated attacker to supply script-capable input that reaches browser output without adequate neutralization. The CNA vector requires victim interaction and assigns changed scope with low confidentiality, integrity and availability impact. Script executes in the site's origin when a victim interacts with the affected output.

GeoDirectory is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.8.172.

GeoDirectory through 2.8.169 exposes the geodir_auto_save_post and geodir_delete_revision AJAX actions with a geodir-save-post nonce. A Subscriber can place post_type=attachment only in the query string to bypass a check that inspects POST while the handlers consume the combined request. The attacker can convert an owned GeoDirectory auto-draft into an attachment and inject file paths into attachment metadata; later GeoDir_Post_Data::delete_revision() and wp_delete_post() dereference those paths and unlink the files. The exact attachment metadata subkeys are not disclosed.

GeoDirectory before 2.8.169 does not authorize requests for map-marker data for a specified listing. An unauthenticated attacker can request a pending or draft listing and obtain its title and exact geographic coordinates.

GeoDirectory before 2.8.168 does not limit a user-search handler to callers with permission to list WordPress users. Any authenticated user with Contributor access or higher can query it and retrieve email addresses for all registered users, including administrators. This unscored record received deeper review because it exposes a low-privilege user-enumeration and contact-data primitive.

GeoDirectory before 2.8.110 stores a place-category setting without adequate sanitization and later renders it on an administrative page without output escaping. An Editor or another high-privilege user who is not allowed unfiltered_html can persist JavaScript that executes when a privileged user opens the affected page. This unscored record received deeper review because stored XSS can reach an administrator, including in multisite configurations.

GeoDirectory is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is n/a through 2.8.161.

GeoDirectory is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.8.162.

GeoDirectory is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.8.152.

GeoDirectory is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.8.157.

GeoDirectory is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory is affected by broken access control. Exploitation requires an authenticated author account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

GeoDirectory is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

GeoDirectory is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

GeoDirectory – WordPress Business Directory Plugin, or Classified Directory is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory – WordPress Business Directory Plugin, or Classified Directory is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

GeoDirectory is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

GeoDirectory is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GeoDirectory Business Directory is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.