CVE-2026-120082

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.200 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nested shortcode payload ([gd_dynamic_conten[gd_tags]t ...]) defeats the plugin's geodir_strip_shortcodes() guard because WordPress's strip_shortcodes() performs only a single pass over registered tags, and HTML-entity-encoded attributes in the resulting shortcode survive wp_kses_post() because kses inspects HTML tags rather than shortcode attribute values.

• CWE-79

• https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.200/includes/class-geodir-ajax.php#L830
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.200/includes/class-geodir-post-data.php#L1732
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.200/includes/formatting-functions.php#L640
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.200/includes/widgets/class-geodir-widget-dynamic-content.php#L169
• https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.200/includes/widgets/class-geodir-widget-dynamic-content.php#L456
• https://plugins.trac.wordpress.org/changeset/3779924/geodirectory/trunk/includes/widgets/class-geodir-widget-dynamic-content.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2db386bd-3edc-48ae-9e32-ac57d472ab5b?source=cve

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120066On Unix-like systems, when logging is enabled, psqlODBC crea…5.3
• CVE-2026-120067For updatable cursors, which are enabled by default, psqlODB…5.9
• CVE-2026-12007Use after free in Core in Google Chrome on Windows prior to …8.8
• CVE-2026-120070The User Frontend – Membership, User Registration, User Prof…8.8
• CVE-2026-120075The WP Activity Log plugin for WordPress is vulnerable to St…7.2
• CVE-2026-12008Use after free in DigitalCredentials in Google Chrome prior …8.3
• CVE-2026-12009Insufficient validation of untrusted input in Accessibility …8.3
• CVE-2026-120091Temporal Server compiles a Worker Controller Instance module…8.7
• CVE-2026-1201An Authorization Bypass Through User-Controlled Key vulnerab…9.4
• CVE-2026-12010Heap buffer overflow in GPU in Google Chrome on Android prio…8.3
• CVE-2026-12011Use after free in WebMIDI in Google Chrome on Windows prior …8.3
• CVE-2026-120114The Debug Log Manager – Conveniently Monitor and Inspect Err…7.2