Skip to contentPaolo Geodirectory vulnerabilities
- ayecode ltd geodirectoryWordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1242507.1 High
- paolo geodirectoryGeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content DisclosureCVE-2026-1142705.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content ShortcodeCVE-2026-1134942.7 Low
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' AttributeCVE-2026-1134886.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeCVE-2026-1134876.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing ModificationCVE-2026-1136743.7 Low
- paolo geodirectoryGeoDirectory < 2.8.194 - Admin+ RCE via DB Text ExportCVE-2026-1136737.2 High
- paolo geodirectoryGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width AttributeCVE-2026-1134936.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX ActionCVE-2026-1134925.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path TraversalCVE-2026-1134916.4 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST EndpointCVE-2026-1134905.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDORCVE-2026-1134894.3 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerabilityCVE-2026-848139.3 Critical
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-812718.8 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-666047.1 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-685656.5 Medium
- paolo geodirectoryGeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST EndpointCVE-2026-169887.5 High
- paolo geodirectoryGeoDirectory < 2.8.110 - Editor+ Stored XSS via Place CategoriesCVE-2025-156773.5 Low
- paolo geodirectoryGeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_usersCVE-2026-169686.5 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-576816.4 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerabilityCVE-2026-548319.3 Critical
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerabilityCVE-2026-395129.3 Critical
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerabilityCVE-2026-426716.5 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-245494.3 Medium
- ayecode geodirectoryGeoDirectory < 2.8.120 - Contributor+ Stored XSSCVE-2025-62005.9 Medium
- ayecode geodirectoryWordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-562596.5 Medium
- ayecode geodirectoryWordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerabilityCVE-2024-439814.3 Medium
- ayecode geodirectoryWordPress GeoDirectory plugin <= 2.3.80 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-504376.5 Medium
- ayecode geodirectoryWordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerabilityCVE-2024-431458.5 High
- paolo geodirectoryGeoDirectory < 2.2.24 - Admin+ SQLiCVE-2023-02787.2 High
- ayecode geodirectoryGeoDirectory < 2.2.22 - Contributor+ Stored XSS via ShortcodeCVE-2022-47755.4 Medium