GeoDirectory WordPress plugin stored XSS flaw

Anyone can plant bad scripts on pages of a WordPress business directory plugin.

Summary

An unauthenticated attacker can inject malicious scripts into pages, which run when a user opens an injected page. All versions up to and including 2.8.200 are affected.

What to do

No fixed version is named in the sources. Check that the plugin runs a version newer than 2.8.200 and read the vendor's advisory.

Products and platforms

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

CVE IDs

CVE-2026-120082 (opens in a new tab)

Times

First published 2026-11-07 02:29 UTC

First seen 2026-11-09 18:40 UTC