WordPress plugin
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 53 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High13
- Medium39
- Low0
All GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.202Update to 2.8.203
- High7.2Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
≤2.8.200Update to 2.8.201
- High7.2Authenticated (Administrator+) Remote Code Execution
≤2.8.193Update to 2.8.194
- High8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
≤2.8.187Update to 2.8.188
- High7.5Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
≤2.8.186Update to 2.8.187
- High7.5Unauthenticated SQL Injection
≤2.8.174Update to 2.8.175
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.173Update to 2.8.174
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
≤2.8.169Update to 2.8.170
- High7.5Unauthenticated SQL Injection
≤2.8.162Update to 2.8.163
- High7.5Unauthenticated SQL Injection
≤2.8.152Update to 2.8.154
- High7.5Unauthenticated SQL Injection
≤2.8.97Update to 2.8.98
- Critical9.9Authenticated (Subscriber+) SQL Injection
≤2.3.61Update to 2.3.62
- High7.2Authenticated (Administrator+) SQL Injection via orderby
≤2.3.28Update to 2.3.29
- High7.2Authenticated (Admin+) SQL Injection
≤2.2.23Update to 2.2.24
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: common questions
Does GeoDirectory – WP Business Directory Plugin and Classified Listings Directory have known vulnerabilities?
Yes. VulnCrest Radar lists 53 known vulnerabilities in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: 1 critical, 13 high, 39 medium. None are known to affect version null.
How do I check which version of GeoDirectory – WP Business Directory Plugin and Classified Listings Directory I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerability?
CVE-2026-124250, published Nov 9, 2026: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.202 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerability listed in CISA KEV?
No. None of the known GeoDirectory – WP Business Directory Plugin and Classified Listings Directory vulnerabilities is currently listed in the CISA KEV catalog.