CVE-2026-111069 in GeoDirectory Plugin
Summary
by MITRE • 10/16/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The GeoDirectory plugin for WordPress, specifically versions up through 2.8.192, contains a critical security flaw classified as Stored Cross-Site Scripting within its business directory and classified listings functionality. This vulnerability stems from insufficient input sanitization and output escaping mechanisms when processing the twitterusername parameter associated with user-generated content such as business profiles or listing details. The core technical failure lies in the plugin's reliance on client-side validation to enforce data integrity, specifically using an HTML pattern attribute that restricts input to alphanumeric characters only for the Twitter username field. While this frontend constraint appears to limit what users can submit, it is not mirrored by robust server-side validation logic. Consequently, attackers who possess authenticated access at the subscriber level or higher can bypass these client-side restrictions entirely by manipulating HTTP requests directly, submitting payloads that break out of the expected alphanumeric format and inject arbitrary JavaScript code into the database storage layer.
From a technical perspective, this represents a classic case where frontend security controls are mistakenly treated as sufficient for data validation without corresponding backend enforcement. The vulnerability allows an attacker to store malicious scripts in custom field tables associated with listings. When other users or administrators view these compromised pages, the injected script executes within their browser context under the trust relationship of the website domain. This execution environment enables the attacker to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions on behalf of victims, or defacing content. The impact is particularly severe because it requires only subscriber-level access, which is often one of the lowest privilege tiers in WordPress installations, making the attack surface significantly broader than vulnerabilities requiring administrator privileges.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under Stored XSS where the malicious script is permanently stored on target servers such as in a database or comment field. The exploitation technique maps to MITRE ATT&CK techniques related to Client-side Injection and potentially Account Manipulation if used for persistence or privilege escalation via session theft. The lack of server-side validation against known dangerous characters or patterns constitutes a fundamental design flaw that violates secure coding principles regarding input handling and output encoding.
Mitigation strategies must address both the immediate technical gap and broader security hygiene practices. Administrators should immediately update GeoDirectory to version 2.8.193 or later where this issue has been resolved by implementing proper server-side sanitization and escaping for all user-supplied data, particularly in custom fields that are rendered on public-facing pages. Until an upgrade is feasible, administrators can implement Web Application Firewall rules to detect and block requests containing script tags or encoded JavaScript patterns within the twitterusername parameter. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting where scripts can be loaded from and executed. Regular security audits focusing on input validation layers across all custom fields are recommended to prevent similar bypasses in other parts of the plugin ecosystem.