VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory security & vulnerabilities

geodirectory— active installsLast vulnerability Nov 9, 2026

No known unpatched vulnerabilities in the latest version

All 53 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
53Known vulnerabilities
  • Critical1
  • High13
  • Medium39
  • Low0
Vulnerabilities per year
2021: 1 vulnerability1212022: 2 vulnerabilities2222023: 3 vulnerabilities3232024: 5 vulnerabilities5242025: 4 vulnerabilities4252026: 38 vulnerabilities3826

All GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.202Update to 2.8.203
CVE-2026-124250
High7.2Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
≤2.8.200Update to 2.8.201
CVE-2026-120082
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
≤2.8.197Update to 2.8.198
CVE-2026-116752
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
≤2.8.199Update to 2.8.200
CVE-2026-119113
Medium6.5Unauthenticated Shortcode Injection via 'pagination_info' Parameter
≤2.8.198Update to 2.8.199
CVE-2026-118635
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<2.8.196Update to 2.8.196
CVE-2026-113487
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<2.8.196Update to 2.8.196
CVE-2026-113488
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
<2.8.195Update to 2.8.195
CVE-2026-113494
Medium5.3Unauthenticated Information Exposure
≤2.8.196Update to 2.8.197
CVE-2026-114270
Medium5.3Unauthenticated Information Exposure
≤2.8.193Update to 2.8.194
CVE-2026-113490
Medium5.3Missing Authorization
≤2.8.193Update to 2.8.194
CVE-2026-113674
High7.2Authenticated (Administrator+) Remote Code Execution
≤2.8.193Update to 2.8.194
CVE-2026-113673
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.193Update to 2.8.194
CVE-2026-113493
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.8.193Update to 2.8.194
CVE-2026-113489
Medium6.5Authenticated (Subscriber+) Arbitrary Media File Read
≤2.8.193Update to 2.8.194
CVE-2026-113491
Medium5.3Unauthenticated Information Exposure
≤2.8.193Update to 2.8.194
CVE-2026-113492
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
≤2.8.191Update to 2.8.192
CVE-2026-110703
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
≤2.8.192Update to 2.8.193
CVE-2026-111069
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
≤2.8.190Update to 2.8.191
CVE-2026-107650
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
≤2.8.190Update to 2.8.191
CVE-2026-107754
High8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
≤2.8.187Update to 2.8.188
CVE-2026-104899
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
≤2.8.188Update to 2.8.189
CVE-2026-104993
High7.5Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
≤2.8.186Update to 2.8.187
CVE-2026-103913
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
≤2.8.183Update to 2.8.184
CVE-2026-96766
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
≤2.8.181Update to 2.8.182
CVE-2026-93897
High7.5Unauthenticated SQL Injection
≤2.8.174Update to 2.8.175
CVE-2026-84813
Medium4.3Cross-Site Request Forgery
≤2.8.176Update to 2.8.177
CVE-2026-81271
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.173Update to 2.8.174
CVE-2026-66604
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.177Update to 2.8.178
CVE-2026-68565
High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
≤2.8.169Update to 2.8.170
CVE-2026-19091
Medium5.3Unauthenticated Pending/Draft Listing Disclosure
≤2.8.168Update to 2.8.169
CVE-2026-16988
Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤2.8.109Update to 2.8.110
CVE-2025-15677
Medium4.3Information Exposure to Authenticated (Contributor+) User Email Disclosure
≤2.8.167Update to 2.8.168
CVE-2026-16968
Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
≤2.8.161Update to 2.8.162
CVE-2026-57681
High7.5Unauthenticated SQL Injection
≤2.8.162Update to 2.8.163
CVE-2026-54831
Medium5.3Missing Authorization
≤2.8.157Update to 2.8.158
CVE-2026-42671
High7.5Unauthenticated SQL Injection
≤2.8.152Update to 2.8.154
CVE-2026-39512
Medium4.3Cross-Site Request Forgery
≤2.8.149Update to 2.8.150
CVE-2026-24549
Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
≤2.8.139Update to 2.8.140
CVE-2025-12833
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.119Update to 2.8.120
CVE-2025-6200
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter
≤2.8.97Update to 2.8.98
CVE-2024-13506
High7.5Unauthenticated SQL Injection
≤2.8.97Update to 2.8.98
CVE-2024-13507
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.84Update to 2.3.85
CVE-2024-56259
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.3.80Update to 2.3.81
CVE-2024-50437
Medium4.3Missing Authorization via geodirectory_rated()
≤2.3.70Update to 2.3.71
CVE-2024-43981
Critical9.9Authenticated (Subscriber+) SQL Injection
≤2.3.61Update to 2.3.62
CVE-2024-43145
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode
≤2.3.48Update to 2.3.49
CVE-2024-3732
Medium6.6Authenticated(Administrator+) SQL Injection
<2.3.29Update to 2.3.29
CVE-2023-50845
High7.2Authenticated (Administrator+) SQL Injection via orderby
≤2.3.28Update to 2.3.29
—
High7.2Authenticated (Admin+) SQL Injection
≤2.2.23Update to 2.2.24
CVE-2023-0278
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.2.21Update to 2.2.22
CVE-2022-4775
Medium4.1CSV Injection
≤2.2.19Update to 2.2.20
—
Medium6.4Authenticated (admin+) Stored Cross-Site Scripting
≤2.1.1.2Update to 2.1.1.3
CVE-2021-24720

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: common questions

Does GeoDirectory – WP Business Directory Plugin and Classified Listings Directory have known vulnerabilities?

Yes. VulnCrest Radar lists 53 known vulnerabilities in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: 1 critical, 13 high, 39 medium. None are known to affect version null.

How do I check which version of GeoDirectory – WP Business Directory Plugin and Classified Listings Directory I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerability?

CVE-2026-124250, published Nov 9, 2026: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.202 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerability listed in CISA KEV?

No. None of the known GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?