{"id":"CVE-2026-93897","aliases":["EUVD-2026-86533","GHSA-hg79-3mhg-pxqx"],"status":"published","title":"GeoDirectory \u003c= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) to bypass the strpos()-gated tag-stripping check.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00209,"percentile":0.11182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-25T06:39:51Z","modified":"2026-09-25T14:17:24Z","products":[{"vendor":"paoltaia","product":"geodirectory – wp business directory plugin and classified listings directory"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1390b079-784c-4c36-bec4-a70cd8484ca5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/post-functions.php#L1347"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/formatting-functions.php#L56"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/post-functions.php#L1803"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.181/includes/class-geodir-ajax.php#L821"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3705730%40geodirectory\u0026new=3705730%40geodirectory"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93897"},{"url":"https://github.com/advisories/GHSA-hg79-3mhg-pxqx"}],"sources":{"cve":[{"id":"CVE-2026-93897","title":"GeoDirectory \u003c= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) to bypass the strpos()-gated tag-stripping check.","status":"published","published":"2026-09-25T06:39:51.76Z","modified":"2026-09-25T13:29:12.8Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-86533","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) to bypass the strpos()-gated tag-stripping check.","status":"published","published":"2026-09-25T06:39:51Z","modified":"2026-09-25T13:29:12Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:55.413842Z"}],"ghsa":[{"id":"GHSA-hg79-3mhg-pxqx","title":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for...","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) to bypass the strpos()-gated tag-stripping check.","status":"published","published":"2026-09-25T09:31:06Z","modified":"2026-09-25T09:31:14Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:24.174061Z"}],"nvd":[{"id":"CVE-2026-93897","description":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) to bypass the strpos()-gated tag-stripping check.","status":"published","published":"2026-09-25T07:16:56.37Z","modified":"2026-09-25T14:17:24.443Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:51.388161Z"}]}}