CVE-2026-120082

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.201

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). By using a nested shortcode payload, attackers can bypass the geodir strip shortcodes() guard and the wp kses post() function, which fails to inspect shortcode attribute values. This enables the injection of arbitrary web scripts into pages via the post content parameter, which execute when a user visits the affected page.

Recommendations Update the plugin to version 2.8.201 or later.