{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/geodirectory/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:geodirectory:geodirectory:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-120082"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (\u003c= 2.8.200)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GeoDirectory"],"content_html":"\u003cp\u003eThe GeoDirectory WordPress plugin (up to and including version 2.8.200) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to sufficiently sanitize input or escape output in the 'post_content' parameter. An unauthenticated attacker can exploit this by crafting a nested shortcode payload, such as \u003ccode\u003e[gd_dynamic_conten[gd_tags]t ...]\u003c/code\u003e, which causes the plugin's \u003ccode\u003egeodir_strip_shortcodes()\u003c/code\u003e function to fail. Because WordPress's built-in \u003ccode\u003estrip_shortcodes()\u003c/code\u003e processes tags in a single pass, and \u003ccode\u003ewp_kses_post()\u003c/code\u003e focuses on HTML tags rather than shortcode attributes, malicious HTML-entity-encoded payloads are rendered and executed in the context of users viewing the injected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts (XSS) within the browser of any user who accesses an affected page. This could lead to session hijacking, unauthorized actions performed on behalf of the user, or unauthorized content modification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the GeoDirectory WordPress plugin to the latest available version beyond 2.8.200.\u003c/li\u003e\n\u003cli\u003eUntil patched, disable the ability for untrusted users to submit or edit posts containing shortcodes.\u003c/li\u003e\n\u003cli\u003eAudit WordPress site logs for suspicious HTTP POST requests targeting content submission endpoints containing unusual shortcode structures or nested brackets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T03:46:27Z","date_published":"2026-11-07T03:46:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-geodirectory-xss/","summary":"The GeoDirectory WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the post_content parameter, allowing unauthenticated attackers to execute arbitrary web scripts by bypassing shortcode sanitization filters.","title":"GeoDirectory: Stored Cross-Site Scripting (CVE-2026-120082)","url":"https://feed.craftedsignal.io/briefs/2026-11-geodirectory-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - GeoDirectory","version":"https://jsonfeed.org/version/1.1"}