CVE-2026-96766 in GeoDirectory Plugin
Summary
by MITRE • 09/25/2026
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The GeoDirectory plugin for WordPress, specifically versions up through 2.8.183, contains a critical security flaw classified as Stored Cross-Site Scripting within the business_hours parameter of its AJAX save handler. This vulnerability stems from insufficient input sanitization and output escaping mechanisms that fail to properly validate or encode user-supplied data before it is stored in the database and subsequently rendered on web pages. The technical root cause lies in the authentication logic used by the plugin's backend processing routines, which rely exclusively on verifying post authorship and a valid nonce token rather than enforcing strict capability checks based on WordPress roles. This architectural oversight allows any user with subscriber-level access or higher who owns a listing to manipulate the business hours field without restriction from administrative privileges.
From an operational perspective, this flaw enables authenticated attackers to inject arbitrary web scripts into pages that are viewed by other users. Because the vulnerability is stored in the database via the AJAX handler, the malicious payload persists and executes automatically whenever any user accesses a page containing the compromised listing data. This transforms what might otherwise be a limited privilege escalation issue into a persistent threat vector capable of compromising session cookies, redirecting users to phishing sites, or defacing web content for visitors who have no direct interaction with the attacker's account beyond viewing public-facing listings. The impact is particularly severe in business directory contexts where user trust and data integrity are paramount, as it undermines the confidentiality and integrity guarantees expected by both site administrators and end-users.
In terms of industry standard classifications, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism of storing malicious scripts in a database for later execution is categorized under the Stored XSS sub-type within this weakness definition. Furthermore, from an offensive security framework perspective such as MITRE ATT&CK, this behavior corresponds to techniques involving Client-Side Injection and potentially Account Manipulation if used to escalate privileges or maintain persistence through compromised user sessions. The lack of proper capability checks also reflects CWE-269, Improper Privilege Management, indicating that the application does not adequately restrict actions based on the user's assigned role within the WordPress ecosystem.
To mitigate this vulnerability, immediate action is required by upgrading the GeoDirectory plugin to a version later than 2.8.183 where these input validation and output escaping issues have been addressed. Site administrators should ensure that all plugins are kept up to date with security patches released by their vendors. Additionally, implementing Web Application Firewalls can provide an additional layer of defense by filtering out malicious payloads in HTTP requests before they reach the application logic. For environments where immediate patching is not feasible, restricting user roles and enforcing stricter capability checks on AJAX handlers through custom code modifications or third-party security plugins may help reduce the attack surface until a full upgrade can be performed. Regular auditing of plugin source code for proper sanitization functions such as wp_kses_post or esc_html_ is also recommended to prevent similar issues in other parts of the application.