Geodirectory

WordPress plugin · geodirectory · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Geodirectory on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113673	Oct 24, 2026
HIGH CVSS 7.5	GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint CVE.org	>=0, <2.8.169	v2.8.169	CVE-2026-16988	Aug 9, 2026
MEDIUM CVSS 5.3	GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure CVE.org	>=0, <2.8.197	v2.8.197	CVE-2026-114270	Oct 29, 2026
MEDIUM CVSS 6.8	GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute CVE.org	>=0, <2.8.196	v2.8.196	CVE-2026-113488	Oct 28, 2026
MEDIUM CVSS 6.8	GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute CVE.org	>=0, <2.8.196	v2.8.196	CVE-2026-113487	Oct 28, 2026
MEDIUM CVSS 5.3	GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113490	Oct 24, 2026
MEDIUM CVSS 6.4	GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113491	Oct 24, 2026
MEDIUM CVSS 5.3	GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113492	Oct 24, 2026
MEDIUM CVSS 6.8	GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113493	Oct 24, 2026
MEDIUM CVSS 4.3	GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113489	Oct 24, 2026
MEDIUM CVSS 6.5	GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users CVE.org	>=0, <2.8.168	v2.8.168	CVE-2026-16968	Aug 5, 2026
LOW CVSS 2.7	GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode CVE.org	>=0, <2.8.195	v2.8.195	CVE-2026-113494	Oct 28, 2026
LOW CVSS 3.7	GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification CVE.org	>=0, <2.8.194	v2.8.194	CVE-2026-113674	Oct 24, 2026
LOW CVSS 3.5	GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories CVE.org	>=0, <2.8.110	v2.8.110	CVE-2025-15677	Aug 5, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.