CVE-2025-15677

Name of the Vulnerable Software and Affected Versions GeoDirectory WordPress plugin versions prior to 2.8.110

Description Insufficient sanitization and escaping of a place-category setting before it is output on an admin page allows high-privilege users, such as editors and above, to execute Stored Cross-Site Scripting (XSS) attacks. This occurs even in environments where the unfiltered html capability is disabled, such as multisite setups. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server.

Recommendations Update GeoDirectory WordPress plugin to version 2.8.110 or later.