Description

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:34.063Z",
  "pubdate": "2026-08-20T12:16:34.063Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the GeoDirectory plugin affecting versions 2.8.173 and prior. This security flaw enables remote attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to other users visiting the vulnerable WordPress site. The vulnerability stems from insufficient sanitization or validation of user-supplied input before it is reflected back in the application's HTTP response. Successful exploitation of this vulnerability requires no prior authentication or administrative privileges, significantly lowering the attack barrier for malicious actors across the network vector. The primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users, and the potential defacement or manipulation of the Document Object Model (DOM) of the affected web application. Risk implications are severe, as arbitrary script execution within the context of a victim's browser session bypasses standard perimeter security controls and undermines application integrity. Mitigation necessitates updating the GeoDirectory plugin to a patched version once available or applying strict input sanitization and output encoding controls to parameters handled by the vulnerable component.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw residing within the GeoDirectory plugin, specifically impacting versions 2.8.173 and earlier. The root cause of the vulnerability is the inadequate validation and sanitization of input data supplied by users, coupled with the absence of proper contextual output encoding when this data is rendered within the Document Object Model (DOM) of the browser. Because the vulnerability is unauthenticated, an external attacker can interact directly with the web application over the network without requiring any prior credentials or privileged access levels.\nThe attack flow begins when an attacker crafts a malicious HTTP request containing a payload constructed with executable JavaScript enclosed within HTML tags or event handlers. This crafted input is directed toward vulnerable entry points within the GeoDirectory plugin. Due to the lack of input filtering, the application ingests the malicious payload and subsequently reflects it back within the HTTP response body without applying secure output encoding mechanisms such as HTML entity encoding.\nWhen a victim visits the compromised page or interacts with the crafted link, the victim's web browser processes the HTTP response and executes the injected script within the security context of the user's session. The payload behavior can range from extracting sensitive data, such as session cookies and local storage tokens, to performing unauthorized API requests on behalf of the authenticated user. Post-exploitation impact includes complete session compromise, potential escalation of privileges if an administrative user falls victim to the exploit, and persistent or reflective malicious interactions depending on how the payload is handled by the underlying component."
}