GeoDirectory WordPress plugin: Reflected cross-site scripting

Summary

A reflected cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin allows an attacker to inject malicious scripts into pages of the affected site. The attack requires a victim, typically a logged-in administrator, to open a crafted link or visit a crafted page. Successful exploitation can allow theft of session data or credentials and actions in the victim's browser context.

Affected

• GeoDirectory WordPress plugin, versions from n/a through 2.8.202 (per Patchstack and CVE record; lower bound not confirmed)

Fixed in

• Version 2.8.203 according to Patchstack and the CVE record solution; not independently verified against the vendor changelog.

Workaround

• Unknown. No vendor-confirmed workaround was found.
• Patchstack reports a mitigation rule that blocks attacks until the plugin is updated; this is only available with a Patchstack subscription.

Exploitation

• Patchstack classifies the priority as medium and expects exploitation; it notes the vulnerability type is used in mass-exploit campaigns.
• No confirmed public proof of concept or exploitation in the wild was found for this CVE.
• User interaction is required (UI:R).

Our recommendation

• Inventory all WordPress sites running GeoDirectory and record exact versions.
• Update GeoDirectory to version 2.8.203 or later, or the latest available release, and verify the installed version afterwards.
• Until updated, restrict access to affected pages where possible and consider a web application firewall with XSS rules.
• Review administrator accounts and sessions, and warn administrators not to open unknown links while logged in.
• Monitor for suspicious links and unexpected administrative activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: WordPress GeoDirectory Plugin <= 2.8.202 XSS patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:22.