EN ES
Start free
Menu

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: known security problems

50 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 50 known security problems on this page. Each one has a fixed version. Updating to version 2.8.200 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.197)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.197
Fixed in
2.8.198
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.198 or newer.
Official ID
CVE-2026-116752
Report title
GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.199)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.199
Fixed in
2.8.200
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.200 or newer.
Official ID
CVE-2026-119113
Report title
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.198
Fixed in
2.8.199
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.199 or newer.
Official ID
CVE-2026-118635
Report title
GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 2.8.196)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.196
Fixed in
2.8.196
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.196 or newer.
Official ID
CVE-2026-113488
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 2.8.196) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.196
Fixed in
2.8.196
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.196 or newer.
Official ID
CVE-2026-113487
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (before 2.8.195)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.195
Fixed in
2.8.195
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.195 or newer.
Official ID
CVE-2026-113494
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.193)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113493
Report title
GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 2.8.193)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113491
Report title
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Arbitrary Media File Read
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 2.8.193)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113492
Report title
GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 2.8.193) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113490
Report title
GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 2.8.193) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113489
Report title
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

Someone who already has an admin account could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113673
Report title
GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.8.193)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.193
Fixed in
2.8.194
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.194 or newer.
Official ID
CVE-2026-113674
Report title
GeoDirectory <= 2.8.193 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.191)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.191
Fixed in
2.8.192
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.192 or newer.
Official ID
CVE-2026-110703
Report title
GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.192)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.192
Fixed in
2.8.193
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.193 or newer.
Official ID
CVE-2026-111069
Report title
GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.190)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.190
Fixed in
2.8.191
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.191 or newer.
Official ID
CVE-2026-107650
Report title
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.190) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.190
Fixed in
2.8.191
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.191 or newer.
Official ID
CVE-2026-107754
Report title
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
First reported
Sources
This week

A stranger could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.187
Fixed in
2.8.188
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.188 or newer.
Official ID
CVE-2026-104899
Report title
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.188)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.188
Fixed in
2.8.189
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.189 or newer.
Official ID
CVE-2026-104993
Report title
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.8.186)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.186
Fixed in
2.8.187
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.187 or newer.
Official ID
CVE-2026-103913
Report title
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.183)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.183
Fixed in
2.8.184
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.184 or newer.
Official ID
CVE-2026-96766
Report title
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.181)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.181
Fixed in
2.8.182
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.182 or newer.
Official ID
CVE-2026-93897
Report title
GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.8.174)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.174
Fixed in
2.8.175
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.175 or newer.
Official ID
CVE-2026-84813
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.8.176)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.176
Fixed in
2.8.177
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.177 or newer.
Official ID
CVE-2026-81271
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.173
Fixed in
2.8.174
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.174 or newer.
Official ID
CVE-2026-66604
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.177)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.177
Fixed in
2.8.178
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.178 or newer.
Official ID
CVE-2026-68565
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.169
Fixed in
2.8.170
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.170 or newer.
Official ID
CVE-2026-19091
Report title
GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 2.8.168)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.168
Fixed in
2.8.169
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.169 or newer.
Official ID
CVE-2026-16988
Report title
GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure
First reported
Sources
This week

Someone with an editor account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.109
Fixed in
2.8.110
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.110 or newer.
Official ID
CVE-2025-15677
Report title
GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.8.167)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.167
Fixed in
2.8.168
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.168 or newer.
Official ID
CVE-2026-16968
Report title
GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could make your server visit other addresses on their behalf

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.161
Fixed in
2.8.162
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.162 or newer.
Official ID
CVE-2026-57681
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.8.162)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.162
Fixed in
2.8.163
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.163 or newer.
Official ID
CVE-2026-54831
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.8.157)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.157
Fixed in
2.8.158
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.158 or newer.
Official ID
CVE-2026-42671
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.8.152)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.152
Fixed in
2.8.154
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.154 or newer.
Official ID
CVE-2026-39512
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.8.149)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.149
Fixed in
2.8.150
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.150 or newer.
Official ID
CVE-2026-24549
Report title
GeoDirectory <= 2.8.149 - Cross-Site Request Forgery
First reported
Sources
This week

Someone with an author account on your site could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.139
Fixed in
2.8.140
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.140 or newer.
Official ID
CVE-2025-12833
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.119)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.119
Fixed in
2.8.120
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.120 or newer.
Official ID
CVE-2025-6200
Report title
GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.97)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.97
Fixed in
2.8.98
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.98 or newer.
Official ID
CVE-2024-13506
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.8.97)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.97
Fixed in
2.8.98
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.8.98 or newer.
Official ID
CVE-2024-13507
Report title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.3.84)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.84
Fixed in
2.3.85
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.85 or newer.
Official ID
CVE-2024-56259
Report title
GeoDirectory <= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.3.80)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.80
Fixed in
2.3.81
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.81 or newer.
Official ID
CVE-2024-50437
Report title
GeoDirectory <= 2.3.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.3.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.70
Fixed in
2.3.71
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.71 or newer.
Official ID
CVE-2024-43981
Report title
GeoDirectory <= 2.3.70 - Missing Authorization via geodirectory_rated()
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.61
Fixed in
2.3.62
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.62 or newer.
Official ID
CVE-2024-43145
Report title
GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.3.48)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.48
Fixed in
2.3.49
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.49 or newer.
Official ID
CVE-2024-3732
Report title
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (before 2.3.29)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.3.29
Fixed in
2.3.29
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.29 or newer.
Official ID
CVE-2023-50845
Report title
GeoDirectory <= 2.3.28 - Authenticated(Administrator+) SQL Injection
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 2.3.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.28
Fixed in
2.3.29
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.3.29 or newer.
Report title
GeoDirectory <= 2.3.28 - Authenticated (Administrator+) SQL Injection via orderby
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.23
Fixed in
2.2.24
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.2.24 or newer.
Official ID
CVE-2023-0278
Report title
GeoDirectory <= 2.2.23 - Authenticated (Admin+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.2.21)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.21
Fixed in
2.2.22
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.2.22 or newer.
Official ID
CVE-2022-4775
Report title
GeoDirectory <= 2.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.19
Fixed in
2.2.20
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.2.20 or newer.
Report title
GeoDirectory <= 2.2.19 - CSV Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.1.1.2
Fixed in
2.1.1.3
What to do
If your site has an affected version, update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to version 2.1.1.3 or newer.
Official ID
CVE-2021-24720
Report title
GeoDirectory <= 2.1.1.2 - Authenticated (admin+) Stored Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)