Paoltaia vulnerabilities

Products

• Geodirectory – Wp Business Directory Plugin And Classified Listings Directory 18

Newest

• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content CVE-2026-120082 7.2 HighNovember 7, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection CVE-2026-116752 6.4 MediumOctober 31, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter CVE-2026-119113 6.4 MediumOctober 30, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter CVE-2026-118635 6.5 MediumOctober 30, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute CVE-2026-110703 6.4 MediumOctober 16, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field CVE-2026-111069 6.4 MediumOctober 16, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title CVE-2026-107650 6.4 MediumOctober 14, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title CVE-2026-107754 6.4 MediumOctober 14, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter CVE-2026-104899 8.1 HighOctober 10, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field CVE-2026-104993 6.4 MediumOctober 10, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing CVE-2026-103913 7.5 HighOctober 3, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter CVE-2026-96766 6.4 MediumSeptember 25, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') CVE-2026-93897 6.4 MediumSeptember 25, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-19091 8.1 HighAugust 11, 2026
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment CVE-2025-12833 4.3 MediumNovember 12, 2025
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection CVE-2024-13507 7.5 HighJuly 26, 2025
• paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter CVE-2024-13506 6.4 MediumFebruary 11, 2025
• ayecode geodirectory, paoltaia geodirectory – wp business directory plugin and classified listings directory +1 more GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode CVE-2024-3732 6.4 MediumApril 23, 2024
• ayecode geodirectory, ayecode - wordpress business directory plugins geodirectory – wordpress business directory plugin, or classified directory +1 more WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection CVE-2023-50845 7.6 HighDecember 28, 2023