CVE-2026-104993 in GeoDirectory Plugin
Summary
by MITRE • 10/10/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The GeoDirectory plugin for WordPress, specifically versions up through 2.8.188, contains a critical security flaw classified as Stored Cross-Site Scripting within its business directory and classified listings functionality. This vulnerability stems from insufficient input sanitization and output escaping mechanisms applied to the email custom field parameter, identified technically by the htmlvar_name contact_email. The core issue lies in how user-supplied data is processed when creating or editing listing entries. Instead of strictly validating that the provided value conforms to a standard email format or properly encoding special characters before rendering them on public-facing pages, the application allows raw HTML and JavaScript code to be stored directly within the database records associated with these listings. This lack of rigorous validation creates an injection point where malicious scripts can persist in the system's data store rather than being executed transiently during a single request.
The operational impact of this vulnerability is significant because it enables authenticated attackers, even those holding only subscriber-level access or higher privileges, to compromise the integrity and security of other users interacting with the website. For an attack to be successfully carried out, specific configuration conditions must be met by the site administrator. The administrator must have explicitly added and configured a custom field for contact email that is set to render on the public single-listing output page. Furthermore, the attacker's submitted listing containing the malicious payload must subsequently be approved by an administrator or moderator. Once these conditions are satisfied, any user who visits the affected listing page will trigger the execution of the injected scripts within their browser environment. This persistence distinguishes it from reflected XSS attacks and increases the likelihood of successful exploitation as victims do not need to click a specially crafted link but simply view the compromised content.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious scripts in the database for later execution categorizes it under Stored XSS variants where the payload is preserved on the target server. In terms of threat modeling and attack patterns defined by MITRE ATT&CK, this behavior corresponds to techniques involving Client-Side Injection such as T1059 or more specifically aspects related to Web Application Attack vectors like T1189 Drive-by Compromise if the script leads to malware delivery, or T1204 User Execution if it tricks users into interacting with malicious elements. The attack chain involves Initial Access via legitimate authentication privileges followed by Persistence through data storage and then Execution upon victim interaction.
Mitigation strategies for this vulnerability require immediate action from site administrators who are running affected versions of the GeoDirectory plugin. The primary remediation step is to upgrade the plugin to a version later than 2.8.188 where these input sanitization and output escaping issues have been addressed by the developers. Until an update can be applied, temporary mitigations may include restricting the ability for lower-privileged users like subscribers to submit listings that require approval if such access is not strictly necessary for business operations. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking common XSS payloads in form submissions can provide a layer of defense against exploitation attempts. Regular auditing of custom field configurations and ensuring that only trusted administrators have the ability to modify critical display settings also helps reduce the attack surface associated with this specific configuration-dependent flaw.