Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.200 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nested shortcode payload ([gd_dynamic_conten[gd_tags]t ...]) defeats the plugin's geodir_strip_shortcodes() guard because WordPress's strip_shortcodes() performs only a single pass over registered tags, and HTML-entity-encoded attributes in the resulting shortcode survive wp_kses_post() because kses inspects HTML tags rather than shortcode attribute values.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T03:17:02.673Z",
  "pubdate": "2026-11-07T03:17:02.673Z",
  "executiveSummary": "The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress is susceptible to Stored Cross-Site Scripting (XSS) in versions up to and including 2.8.200.\nThe vulnerability arises from inadequate input sanitization and output escaping within the 'post_content' parameter.\nAn unauthenticated attacker can inject malicious JavaScript payloads that execute in the context of a victim's browser when they access the affected directory pages.\nThis vulnerability poses a significant risk to site integrity and user security, as it allows for unauthorized script execution, potential session hijacking, and defacement.\nThe exploitation does not require prior authentication or elevated privileges, making it a critical threat to public-facing directory instances.\nThe flaw leverages a sophisticated bypass of the plugin's internal security filters, specifically circumventing the geodir_strip_shortcodes() function via nested shortcode construction.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of the 'post_content' parameter and the circumvention of the geodir_strip_shortcodes() security guard. The plugin employs a custom function to strip shortcodes; however, it fails to account for nested shortcode structures.\nThe attacker utilizes a payload constructed as [gd_dynamic_conten[gd_tags]t ...], which exploits the single-pass nature of the underlying WordPress strip_shortcodes() function. By nesting tags in this manner, the malicious shortcode remains intact after the initial sanitization phase, effectively bypassing the security check designed to remove executable content.\nFollowing the bypass, the payload reaches the wp_kses_post() function. This function is designed to sanitize HTML tags and attributes; however, it fails to inspect or sanitize the content within shortcode attributes. Because the payload utilizes HTML-entity-encoded attributes, these values remain unparsed by kses and are stored directly in the database within the 'post_content' field.\nWhen a user or administrator subsequently views a page containing the manipulated 'post_content', the plugin processes the stored shortcode. The server-side rendering engine parses the nested structure and interprets the injected attributes as valid HTML, resulting in the delivery of malicious script tags to the victim's browser.\nBecause the payload is stored persistently in the database, the vulnerability is classified as Stored XSS. Every instance where the injected 'post_content' is rendered causes the script to execute within the victim's session. This allows an unauthenticated attacker to bypass administrative controls and deliver cross-site scripts to all site visitors, including high-privilege users.\nThe attack flow follows a predictable pattern: 1) Crafting a nested, entity-encoded shortcode payload; 2) Submitting this payload via the vulnerable 'post_content' parameter; 3) Exploiting the recursive processing failure in geodir_strip_shortcodes(); 4) Ensuring the payload evades wp_kses_post() by utilizing encoded attribute values; 5) Achieving persistence in the backend database. Once stored, the script executes automatically upon legitimate page load, leading to potential session theft, redirection, or unauthorized actions performed on behalf of the victim."
}