Unknown Geodirectory vulnerabilities
6 vulnerabilities
Known vulnerabilities in Unknown Geodirectory, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-15677unknowngeodirectory+1
EPSS score0.24%
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).CVE-2025-6200ayecodegeodirectory+2EPSS score0.24%
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2022-4775ayecodegeodirectory+2EPSS score0.47%
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.CVE-2026-16988unknowngeodirectory+1EPSS score0.43%
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.CVE-2026-16968unknowngeodirectory+1EPSS score0.37%
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.CVE-2023-0278unknowngeodirectory+2EPSS score0.76%
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.