CVE-2026-93897 in GeoDirectory Plugin
Summary
by MITRE • 09/25/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The GeoDirectory plugin for WordPress, a widely used solution for creating business directories and classified listings, contains a critical security flaw affecting all versions up through 2.8.181. This vulnerability is categorized as a Stored Cross-Site Scripting (XSS) issue that stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of custom fields. Specifically, the defect resides in how text-type custom fields are processed when data is submitted via the AJAX endpoint geodir_save_post. The architecture of this endpoint allows authenticated users to save post metadata, but it fails to adequately validate or escape special characters before storing them in the database and subsequently rendering them on public-facing pages. This lack of rigorous validation creates a pathway for malicious actors to inject executable JavaScript code into legitimate web content.
The technical nature of this vulnerability relies on an evasion technique that bypasses existing protective filters. The plugin employs a strpos()-gated tag-stripping check designed to remove potentially dangerous HTML tags such as script or img elements from user input. However, attackers can circumvent this defense by using entity-encoded angle brackets in their payloads. For instance, instead of submitting raw less-than and greater-than symbols which would be detected and stripped, an attacker submits encoded versions like <img src=x onerror=alert(1)>. The server-side logic fails to decode these entities before the sanitization check occurs or fails to re-escape them upon output. Consequently, when a victim user views the page containing this stored payload, the browser decodes the HTML entities and executes the embedded script, effectively turning the custom field into an execution vector for malicious code.
The operational impact of this vulnerability is significant due to its reliance on authenticated access with subscriber-level privileges or higher. While requiring authentication might seem like a mitigating factor, it lowers the barrier to entry considerably compared to unauthenticated attacks. Any user who can register and log in as a subscriber has the ability to create listings that include custom fields such as phone numbers or addresses. By injecting malicious scripts into these fields, an attacker can persistently store harmful content on the server. When other users, including administrators or customers browsing the directory, access pages displaying this compromised data, their browsers will execute the injected JavaScript in the context of the vulnerable site's domain. This enables a range of attacks including session hijacking, where attackers steal authentication cookies to impersonate legitimate users; credential harvesting through fake login forms embedded via script injection; and defacement or redirection of victims to malicious third-party sites designed for phishing or malware distribution.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored persistence rather than reflected injection, making it more severe due to the persistent nature of the threat. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. Furthermore, the requirement for authentication places this under privilege escalation contexts where lower-privileged users leverage application features to perform actions that compromise system integrity or user data confidentiality. The use of entity encoding to bypass filters is a common pattern in modern XSS attacks and highlights the importance of implementing context-aware output encoding rather than relying solely on input-based filtering strategies which are prone to evasion through alternative encodings.
Mitigation for this vulnerability requires immediate action by site administrators running affected versions of GeoDirectory. The primary remediation step is to upgrade the plugin to a version newer than 2.8.181, where developers have presumably addressed the sanitization and escaping logic in the geodir_save_post endpoint. Until an update can be applied, administrators should consider restricting user registration or limiting the capabilities of subscriber-level accounts if possible within their WordPress configuration. Additionally, implementing a Web Application Firewall (WAF) with rules specifically tuned to detect entity-encoded script injections may provide a layer of defense against exploitation attempts. It is also critical for developers and site owners to ensure that all custom fields are properly escaped using functions like esc_html or wp_kses_post when outputting data in templates, ensuring that any stored malicious content is rendered as plain text rather than executable code. Regular security audits and penetration testing focused on input validation across all user-facing forms can help identify similar weaknesses before they are exploited by adversaries seeking to compromise WordPress-based directory sites.