GeoDirectory: Stored Cross-Site Scripting (CVE-2026-120082)

The GeoDirectory WordPress plugin (up to and including version 2.8.200) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sufficiently sanitize input or escape output in the 'post_content' parameter. An unauthenticated attacker can exploit this by crafting a nested shortcode payload, such as [gd_dynamic_conten[gd_tags]t ...], which causes the plugin's geodir_strip_shortcodes() function to fail. Because WordPress's built-in strip_shortcodes() processes tags in a single pass, and wp_kses_post() focuses on HTML tags rather than shortcode attributes, malicious HTML-entity-encoded payloads are rendered and executed in the context of users viewing the injected page.

Impact

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts (XSS) within the browser of any user who accesses an affected page. This could lead to session hijacking, unauthorized actions performed on behalf of the user, or unauthorized content modification.

Recommendation

• Update the GeoDirectory WordPress plugin to the latest available version beyond 2.8.200.
• Until patched, disable the ability for untrusted users to submit or edit posts containing shortcodes.
• Audit WordPress site logs for suspicious HTTP POST requests targeting content submission endpoints containing unusual shortcode structures or nested brackets.