CVE-2026-96766

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.184

Description The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the business hours parameter. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. The flaw exists because the AJAX save handler only validates post authorship and a nonce without performing additional capability checks, allowing any subscriber who owns a listing to execute the attack.

Recommendations Update to a version newer than 2.8.183. As a temporary mitigation, restrict the ability of subscriber-level users to edit the business hours parameter.