CVE-2026-111069

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.

• CWE-79

• https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-ajax.php#L821
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-post-data.php#L1661
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/class-geodir-post-data.php#L450
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/custom-fields/output-filter-functions.php#L42
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.192/includes/post-functions.php#L1950
• https://plugins.trac.wordpress.org/changeset/3748786/geodirectory/trunk/includes/custom-fields/output-filter-functions.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/32052509-2fa6-4317-8861-314e6da0869f?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11101Uninitialized Use in Dawn in Google Chrome on Windows prior …6.5
• CVE-2026-11102Inappropriate implementation in Isolated Web Apps in Google …8.8
• CVE-2026-11103Inappropriate implementation in Installer in Google Chrome o…7.8
• CVE-2026-11104Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-11105Insufficient validation of untrusted input in WebUI in Googl…6.5
• CVE-2026-11106Inappropriate implementation in Media in Google Chrome prior…6.5
• CVE-2026-11107Inappropriate implementation in Downloads in Google Chrome p…4.3
• CVE-2026-11108Inappropriate implementation in NFC in Google Chrome on Andr…8.8
• CVE-2026-11109Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111091In JetBrains Junie CLI before 26.8.3 code execution was poss…7.8
• CVE-2026-111092In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.…6.5
• CVE-2026-111093In JetBrains Datalore before 2026.2.1 unauthenticated path t…7.5