CVE-2026-116752 in GeoDirectory Plugin
Summary
by MITRE • 10/31/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The GeoDirectory plugin for WordPress, specifically versions up to and including 2.8.197, contains a critical security vulnerability classified as Stored Cross-Site Scripting (XSS). This flaw resides within the handling of the post_images parameter, which is utilized during the process of uploading or managing images associated with business listings and classified ads. The root cause of this vulnerability is insufficient input sanitization combined with inadequate output escaping in the plugin's codebase. When a user submits data containing malicious JavaScript payloads through this specific parameter, the application fails to properly validate or encode the content before storing it in the database. Consequently, when this stored data is later rendered on web pages without proper encoding, the browser interprets and executes the injected scripts as part of the page's legitimate code stream.
The operational impact of this vulnerability extends beyond simple script execution due to its specific trigger mechanism within the editorial workflow. While any authenticated user with subscriber-level access or higher can inject these malicious payloads by uploading images for a listing, the payload does not execute immediately upon submission. Instead, it remains dormant in the database until an administrator or editor opens the edit screen for that pending listing. This delayed execution model means that high-privilege users are targeted when they perform routine administrative tasks such as reviewing or editing content submitted by lower-level users. As a result, this vulnerability facilitates privilege escalation, allowing attackers with minimal initial access to compromise accounts with significantly higher privileges by tricking administrators into executing arbitrary code within their own browser sessions.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the attack vector involves storing malicious content in a persistent data store for later retrieval and execution, fitting the definition of Stored XSS rather than Reflected or DOM-based variants. In terms of threat modeling frameworks such as MITRE ATT&CK, this vulnerability supports techniques associated with Initial Access via Valid Accounts and Execution through Browser Scripting. The ability to escalate privileges from subscriber to administrator level represents a significant risk to the integrity of the WordPress environment, potentially leading to full site compromise if combined with other exploitation vectors or used to install persistent backdoors within the admin interface.
Mitigation strategies for this vulnerability primarily involve upgrading the GeoDirectory plugin to a version newer than 2.8.197 where these sanitization and escaping issues have been addressed by the developers. For organizations unable to upgrade immediately, implementing strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable content is allowed to run. Additionally, enforcing rigorous input validation on all user-supplied data at the application layer and ensuring that output encoding matches the context in which data is rendered are essential defensive measures. Regular security audits and penetration testing focused on file upload functionalities and admin panel interactions can further help identify similar weaknesses before they are exploited by malicious actors seeking to gain unauthorized administrative control over WordPress installations.