Skip to content

Paoltaia Geodirectory vulnerabilities

paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentCVE-2026-1200827.2 HighNovember 7, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter InjectionCVE-2026-1167526.4 MediumOctober 31, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' ParameterCVE-2026-1191136.4 MediumOctober 30, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' ParameterCVE-2026-1186356.5 MediumOctober 30, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url AttributeCVE-2026-1107036.4 MediumOctober 16, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom FieldCVE-2026-1110696.4 MediumOctober 16, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing TitleCVE-2026-1076506.4 MediumOctober 14, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image TitleCVE-2026-1077546.4 MediumOctober 14, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' ParameterCVE-2026-1048998.1 HighOctober 10, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom FieldCVE-2026-1049936.4 MediumOctober 10, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending ListingCVE-2026-1039137.5 HighOctober 3, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' ParameterCVE-2026-967666.4 MediumSeptember 25, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')CVE-2026-938976.4 MediumSeptember 25, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revisionCVE-2026-190918.1 HighAugust 11, 2026
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image AttachmentCVE-2025-128334.3 MediumNovember 12, 2025
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL InjectionCVE-2024-135077.5 HighJuly 26, 2025
paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name ParameterCVE-2024-135066.4 MediumFebruary 11, 2025
ayecode geodirectory, paoltaia geodirectory – wp business directory plugin and classified listings directory +1 moreGeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' ShortcodeCVE-2024-37326.4 MediumApril 23, 2024
ayecode geodirectory, ayecode - wordpress business directory plugins geodirectory – wordpress business directory plugin, or classified directory +1 moreWordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL InjectionCVE-2023-508457.6 HighDecember 28, 2023