CVE-2026-93897

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.182

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into text-type custom fields, such as phone, which then execute when a user visits the affected page. The attack is carried out via the AJAX geodir save post endpoint by using entity-encoded angle brackets to bypass the strpos()-gated tag-stripping check.

Recommendations Update to a version newer than 2.8.181.