Skip to contentPaoltaia Geodirectory – Wp Business Directory Plugin And Classified Listings Directory vulnerabilities
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentCVE-2026-1200827.2 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter InjectionCVE-2026-1167526.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' ParameterCVE-2026-1191136.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' ParameterCVE-2026-1186356.5 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url AttributeCVE-2026-1107036.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom FieldCVE-2026-1110696.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing TitleCVE-2026-1076506.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image TitleCVE-2026-1077546.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' ParameterCVE-2026-1048998.1 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom FieldCVE-2026-1049936.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending ListingCVE-2026-1039137.5 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' ParameterCVE-2026-967666.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')CVE-2026-938976.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revisionCVE-2026-190918.1 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image AttachmentCVE-2025-128334.3 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL InjectionCVE-2024-135077.5 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name ParameterCVE-2024-135066.4 Medium
- ayecode geodirectory, paoltaia geodirectory – wp business directory plugin and classified listings directory +1 moreGeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' ShortcodeCVE-2024-37326.4 Medium