Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?GeoDirectoryevents-for-geodirectory
Plugin · geodirectory
GeoDirectory
45 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026GeoDirectory: Does not perform any status or ownership checkCVE-2026-113494 · fixed in 2.8.195 · reported by WPScanLow 2.7
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
Oct 28, 2026GeoDirectory: Does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handlerCVE-2026-113488 · fixed in 2.8.196 · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
Oct 28, 2026GeoDirectory: Does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listingCVE-2026-113487 · fixed in 2.8.196 · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
Oct 24, 2026GeoDirectory: Does not correctly verify ownership of listings submitted by logged-out users before allowing them to be editedCVE-2026-113674 · fixed in 2.8.194 · reported by WPScanLow 3.7
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
Oct 24, 2026GeoDirectory: Does not properly escape administrator-defined text before writing it into a generated PHP file in its own folderCVE-2026-113673 · fixed in 2.8.194 · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
Oct 24, 2026GeoDirectory: Does not sanitise and escape some of its map shortcode attributes before outputting them within a style attributeCVE-2026-113493 · fixed in 2.8.194 · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
Oct 24, 2026GeoDirectory: Does not perform statusCVE-2026-113492 · fixed in 2.8.194 · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Oct 24, 2026GeoDirectory: Does not validate a user-supplied image URL before using itCVE-2026-113491 · fixed in 2.8.194 · reported by WPScanMedium 6.4
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
Oct 24, 2026GeoDirectory: Does not perform any status or ownership checkCVE-2026-113490 · fixed in 2.8.194 · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
Oct 24, 2026GeoDirectory: Does not verify that a referenced attachment belongs to the listing being savedCVE-2026-113489 · fixed in 2.8.194 · reported by WPScanMedium 4.3
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
Oct 16, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-110703 · affects up to 2.8.191 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-111069 · affects up to 2.8.192 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.
Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107754 · affects up to 2.8.190 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107650 · affects up to 2.8.190 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Oct 10, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Local File InclusionCVE-2026-104899 · affects up to 2.8.187 · reported by WordfenceHigh 8.1
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability.
Oct 10, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-104993 · affects up to 2.8.188 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.
Oct 3, 2026GeoDirectory: SQL InjectionCVE-2026-103913 · affects up to 2.8.186 · reported by WordfenceHigh 7.5
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post=<pending-listing-id> and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-96766 · affects up to 2.8.183 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-93897 · affects up to 2.8.181 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-84813 · affects up to 2.8.174 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-81271 · affects up to 2.8.176 · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.CVE-2026-66604 · affects up to 2.8.173 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.CVE-2026-68565 · affects up to 2.8.172 · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
Aug 11, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Arbitrary file deletionCVE-2026-19091 · affects up to 2.8.169 · reported by WordfenceHigh 8.1
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Aug 9, 2026GeoDirectory: Does not perform any authorization checkCVE-2026-16988 · fixed in 2.8.169 · reported by WPScanHigh 7.5
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
Aug 5, 2026GeoDirectory: Does not restrict a user-search handler to users allowed to list usersCVE-2026-16968 · fixed in 2.8.168 · reported by WPScanMedium 6.5
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
Aug 5, 2026GeoDirectory: Does not sanitise and escape a place-category setting before outputting it back in an admin pageCVE-2025-15677 · fixed in 2.8.110 · reported by WPScanLow 3.5
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Jul 2, 2026Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.CVE-2026-57681 · reported by PatchstackMedium 6.4
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.
Jun 26, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.CVE-2026-54831 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · affects up to 2.8.152 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
Jun 1, 2026GeoDirectory: Missing AuthorizationCVE-2026-42671 · affects up to 2.8.157 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157.
Jan 23, 2026GeoDirectory: Cross-Site Request Forgery (CSRF)CVE-2026-24549 · affects up to 2.8.149 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.149.
Nov 12, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Insecure Direct Object ReferenceCVE-2025-12833 · affects up to 2.8.139 · reported by WordfenceMedium 4.3
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to attach arbitrary image files to arbitrary places.
Jul 26, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Time-based SQL InjectionCVE-2024-13507 · affects up to 2.8.97 · reported by WordfenceHigh 7.5
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2025GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-6200 · fixed in 2.8.120 · reported by WPScanMedium 5.9
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Feb 11, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2024-13506 · affects up to 2.8.97 · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56259 · affects up to 2.3.84 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.84.
Nov 1, 2024GeoDirectory: Missing AuthorizationCVE-2024-43981 · affects up to 2.3.70 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
Oct 28, 2024GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50437 · affects up to 2.3.80 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80.
Aug 18, 2024GeoDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43145 · affects up to 2.3.61 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.
Apr 23, 2024GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Stored Cross-Site ScriptingCVE-2024-3732 · affects up to 2.3.48 · reported by WordfenceMedium 6.4
The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Dec 28, 2023GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50845 · affects up to 2.3.28 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
Feb 27, 2023GeoDirectory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0278 · fixed in 2.2.24 · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Jan 23, 2023GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4775 · fixed in 2.2.22 · reported by WPScanMedium 5.4
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Oct 11, 2021GeoDirectory Business Directory: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-24720 · fixed in 2.1.1.3 · reported by WPScanMedium 5.4
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.