Description

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:17:00.380Z",
  "pubdate": "2026-08-18T15:17:00.380Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the GeoDirectory plugin <= 2.8.172 versions, specifically within functionality accessible to contributors. This security flaw allows authenticated malicious actors with contributor-level privileges to inject arbitrary client-side scripts, such as malicious JavaScript, into web pages rendered to other application users.\nThe primary impact of this vulnerability involves unauthorized script execution within the context of a victim's browser session. If successfully exploited, an attacker could hijack user sessions, bypass access controls, steal sensitive session tokens, manipulate the DOM, or perform unauthorized actions on behalf of other privileged users interacting with the affected GeoDirectory components.\nThe affected product is GeoDirectory versions 2.8.172 and prior. The risk implications are moderate to high depending on the privileges of the targeted users interacting with the injected content, as administrative session hijacking could lead to total site compromise.\nExploitation requires an attacker to possess authenticated access at the contributor role level or higher within the target WordPress instance. The attack vector relies on inadequate input sanitization and output encoding within the vulnerable plugin features, permitting the storage and subsequent execution of malicious payloads when views or forms are rendered by the application.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) issue stemming from insufficient input validation and improper output encoding within GeoDirectory <= 2.8.172. The root cause lies in the application's failure to adequately sanitize user-supplied input submitted by accounts holding contributor privileges before storing it in the database and subsequently reflecting or rendering it in the Document Object Model (DOM).\nAuthentication and privilege requirements mandate that the attacker must have a valid user account with contributor-level access to the WordPress environment where GeoDirectory is installed and active. The vulnerability is typically exploitable via the standard application interface where contributors are permitted to submit or manage data associated with directory listings, posts, or profile fields processed by the plugin.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious payload containing executable JavaScript (e.g., event handlers or script tags). Second, the attacker inputs this payload into a vulnerable input field or parameter processed by GeoDirectory. Third, the application fails to neutralize the malicious constructs and persists the unescaped payload within the database. Fourth, when an unsuspecting user or administrator views the affected directory page, listing, or administrative dashboard interface, the server retrieves and renders the payload without proper HTML entity encoding.\nUpon rendering, the victim's browser interprets the injected payload as legitimate application script and executes it within the security context of the victim's session. The payload behavior can range from simple defacement and redirection to complex programmatic API requests made on behalf of the victim.\nThe post-exploitation impact includes session token exfiltration, unauthorized administrative actions if an administrator views the malicious content, and potential escalation of privileges within the broader WordPress ecosystem. Network exposure is standard web-based HTTP/HTTPS traffic targeting the vulnerable WordPress installation."
}