3.5
Faible
CVE-2025-15677 The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before…
Description
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GeoDirectory 2.8 | premières → < 2.8.110 | 2.8.110 |
Autres CVE de GeoDirectory
Les 17 CVE de GeoDirectory →
CVE-2026-114270
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…
5.3
Moyenne
CVE-2026-113494
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a…
2.7
Faible
CVE-2026-113488
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…
6.8
Moyenne
CVE-2026-113487
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link…
6.8
Moyenne