Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T07:16:56.370Z",
  "pubdate": "2026-09-25T07:16:56.370Z",
  "executiveSummary": "The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a critical Stored Cross-Site Scripting (XSS) vulnerability.\nThe flaw exists in versions up to and including 2.8.181, stemming from inadequate sanitization and output escaping of user-supplied data in custom fields.\nThe vulnerability allows authenticated users with subscriber-level privileges or higher to inject arbitrary malicious JavaScript into directory listings.\nWhen a user or administrator accesses an affected page, the stored payload executes within the context of their session, potentially leading to unauthorized actions, account takeover, or data exfiltration.\nThe exploit bypasses existing security controls by utilizing entity-encoded characters to circumvent basic input filtering mechanisms, presenting a significant risk to the integrity and security of the WordPress site.",
  "technicalDetails": "The vulnerability resides within the geodir_save_post AJAX endpoint, which handles the processing and storage of user-defined custom fields. The root cause is a combination of flawed input sanitization and a failure to enforce context-aware output escaping when rendering data on the front-end or dashboard.\nInput validation is performed via a strpos()-gated check designed to strip dangerous tags; however, this mechanism is insufficient because it only inspects raw string patterns. By submitting a payload using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>), an attacker can successfully bypass this filter, allowing the malicious script to be stored directly in the WordPress database.\nThe attack flow proceeds as follows: First, an attacker with valid subscriber-level credentials navigates to the directory listing modification interface. Second, they inject the obfuscated XSS payload into a text-type custom field, such as the 'phone' field, through the geodir_save_post AJAX request. The backend fails to properly decode or sanitize the input before committing it to the database. Third, when the affected listing is rendered on a public page or within the administrative dashboard, the plugin outputs the payload without applying proper escaping functions (such as esc_html() or esc_js()). Finally, the victim's browser interprets the injected entities as executable HTML tags, triggering the execution of the JavaScript payload.\nBecause the payload is stored persistently in the database, the script executes every time the affected page is loaded, regardless of the victim's specific actions. This enables attackers to perform unauthorized administrative actions if an administrator views the listing, steal session cookies via document.cookie, or redirect users to malicious domains. The vulnerability persists across all versions up to 2.8.181 and represents a failure to implement defense-in-depth strategies regarding data handling in custom plugin fields."
}