Geodirectory (Unknown) - vulnerabilities (CVEs)
16 CVEs, 10 in the last 30 days, 1 known versions, newest CVE from 2026-10-28. Vendor: Unknown.
CVEs of Geodirectory
- CVE-2026-113488 - CVSS 6.8 (medium), 2026-10-28: The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an…
- CVE-2026-113494 - CVSS 2.7 (low), 2026-10-28: The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its…
- CVE-2026-113487 - CVSS 6.8 (medium), 2026-10-28: The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor…
- CVE-2026-113674 - CVSS 3.7 (low), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be…
- CVE-2026-113491 - CVSS 6.4 (medium), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end…
- CVE-2026-113673 - CVSS 7.2 (high), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own…
- CVE-2026-113490 - CVSS 5.3 (medium), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its…
- CVE-2026-113493 - CVSS 6.8 (medium), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style…
- CVE-2026-113492 - CVSS 5.3 (medium), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated…
- CVE-2026-113489 - CVSS 4.3 (medium), 2026-10-24: The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with…
- CVE-2026-16988 - CVSS 7.5 (high), 2026-08-09: The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing,…
- CVE-2025-15677 - CVSS 3.5 (low), 2026-08-05: The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing…
- CVE-2026-16968 - CVSS 6.5 (medium), 2026-08-05: The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with…
- CVE-2025-6200 - CVSS 5.9 (medium), 2025-07-11: The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post…
- CVE-2023-0278 - CVSS 7.2 (high), 2023-02-27: The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL…
- CVE-2022-4775 - CVSS 5.4 (medium), 2023-01-23: The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which…
