Description

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T07:16:57.017Z",
  "pubdate": "2026-09-25T07:16:57.017Z",
  "executiveSummary": "The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in all versions up to and including 2.8.183.\nThe vulnerability arises from improper input sanitization and output escaping within the 'business_hours' parameter. This security defect allows authenticated attackers with subscriber-level privileges, who own a listing, to inject arbitrary JavaScript payloads.\nSuccessful exploitation occurs when an administrator or another user views the compromised page, triggering the execution of the injected script within the context of the victim's browser session. This can lead to unauthorized actions, session hijacking, credential theft, or the defacement of the affected WordPress site.\nThe attack vector is characterized by a failure in the AJAX save handler, which performs authorization checks only on post ownership and nonce verification, neglecting the necessary capability checks to restrict administrative-level modifications. Given that the payload is stored persistently in the database, the impact is continuous until the malicious script is manually removed.",
  "technicalDetails": "The vulnerability resides within the GeoDirectory AJAX save handler responsible for processing business listing updates. Specifically, the 'business_hours' parameter fails to undergo adequate server-side input sanitization or context-aware output escaping before being stored in the database.\nThe root cause is an insufficient authorization and validation logic within the plugin's backend processes. While the handler verifies that the user is the owner of the specific post and validates an associated nonce, it lacks the required capability checks (e.g., 'manage_options' or 'edit_posts') to ensure that a subscriber-level user cannot inject malicious scripts into administrative or public-facing fields.\nThe attack flow proceeds as follows: First, an authenticated attacker possessing a valid subscriber account creates or claims ownership of a listing. Second, the attacker intercept the AJAX request sent to the server during the saving of business hours settings. Third, the attacker modifies the 'business_hours' parameter to include a crafted malicious JavaScript payload. Because the plugin does not sanitize this input, the script is persisted directly into the WordPress database.\nWhen a legitimate user, such as an administrator, accesses a page where the malicious 'business_hours' data is rendered, the application fails to escape the content appropriately. Consequently, the user's browser parses the payload as executable code rather than plain text. This results in the script executing within the victim's session context.\nAs a result of this XSS, the attacker may perform actions on behalf of the victim, such as modifying configuration settings, creating new administrative accounts, or capturing session cookies. The persistent nature of this vulnerability means the script is triggered every time the affected page is loaded, making it a critical risk for site integrity and user account security."
}