CVE-2026-107754 in GeoDirectory Plugin
Summary
by MITRE • 10/14/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The GeoDirectory plugin for WordPress, which serves as a comprehensive solution for creating business directories and classified listings websites, contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to 2.8.190. This vulnerability resides specifically in the post_images parameter, where an attacker can manipulate the file_info[2] field associated with the title attribute of uploaded images. The root cause is insufficient input sanitization and a lack of proper output escaping when processing these image metadata fields. Because the application fails to adequately filter or encode user-supplied data before storing it in the database, malicious scripts are persisted on the server rather than being executed immediately during submission. This persistence mechanism distinguishes stored vulnerabilities from reflected ones, as the payload remains active until manually removed by an administrator, thereby increasing the potential blast radius of the attack significantly.
The operational impact of this vulnerability is severe due to its low privilege requirement and high execution frequency. Authentication with subscriber-level access or higher is sufficient to exploit this flaw, which means that any registered user on a WordPress site running GeoDirectory can initiate the attack without needing administrative privileges. Once an attacker injects arbitrary web scripts through the image title field, these scripts are stored in the database associated with specific directory listings or classified ads. Consequently, every time another user accesses a page containing this compromised listing, the malicious script executes within their browser session. This behavior allows attackers to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions on behalf of victims, defacing websites, or redirecting users to phishing sites. The trust relationship between the website and its visitors is exploited, turning legitimate content into a vector for malicious code execution.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of stored XSS where input is not validated or sanitized before being saved to persistent storage. In terms of offensive security frameworks like MITRE ATT&CK for Enterprise, this exploit maps to techniques involving Client-Side Injection and potentially Account Manipulation if session tokens are stolen. The attack chain typically involves Initial Access via legitimate credentials, followed by Execution through the browser environment when victims view the compromised content. This highlights a critical gap in the plugin's security architecture regarding how it handles metadata associated with media uploads, which is often overlooked compared to more obvious input fields like post titles or descriptions.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. The most effective solution is to upgrade the GeoDirectory plugin to version 2.8.191 or later, where developers have implemented proper sanitization using WordPress functions such as wp_kses_post for input validation and esc_attr for output escaping when rendering image titles in HTML attributes. For sites unable to update immediately due to compatibility concerns, temporary workarounds include restricting the ability of subscriber-level users to upload images with custom metadata if possible through role management plugins or code snippets that disable specific form fields. Additionally, implementing a Content Security Policy header can help mitigate the impact by preventing inline script execution, although this is not a substitute for fixing the underlying vulnerability. Regular security audits and penetration testing focused on file upload mechanisms are recommended to ensure that similar flaws do not exist in other parts of the plugin or theme integration layers.