GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (<= 2.8.200) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/geodirectory--wp-business-directory-plugin-and-classified-listings-directory--2.8.200/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 03:46:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGeoDirectory: Stored Cross-Site Scripting (CVE-2026-120082)https://feed.craftedsignal.io/briefs/2026-11-geodirectory-xss/Sat, 07 Nov 2026 03:46:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-geodirectory-xss/The GeoDirectory WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the post_content parameter, allowing unauthenticated attackers to execute arbitrary web scripts by bypassing shortcode sanitization filters.The GeoDirectory WordPress plugin (up to and including version 2.8.200) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sufficiently sanitize input or escape output in the 'post_content' parameter. An unauthenticated attacker can exploit this by crafting a nested shortcode payload, such as [gd_dynamic_conten[gd_tags]t ...], which causes the plugin's geodir_strip_shortcodes() function to fail. Because WordPress's built-in strip_shortcodes() processes tags in a single pass, and wp_kses_post() focuses on HTML tags rather than shortcode attributes, malicious HTML-entity-encoded payloads are rendered and executed in the context of users viewing the injected page.

Impact

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts (XSS) within the browser of any user who accesses an affected page. This could lead to session hijacking, unauthorized actions performed on behalf of the user, or unauthorized content modification.

Recommendation

  • Update the GeoDirectory WordPress plugin to the latest available version beyond 2.8.200.
  • Until patched, disable the ability for untrusted users to submit or edit posts containing shortcodes.
  • Audit WordPress site logs for suspicious HTTP POST requests targeting content submission endpoints containing unusual shortcode structures or nested brackets.
]]>highadvisory