GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory, with AI-generated Chinese analysis, references, and POCs.

Vendor: paoltaia

CVE ID	Title	CVSS	Severity	Published
CVE-2026-104899	GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter CWE-98	8.1	High	2026-10-10
CVE-2026-104993	GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field CWE-79	6.4	Medium	2026-10-10
CVE-2026-103913	GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing CWE-89	7.5	High	2026-10-03
CVE-2026-96766	GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter CWE-79	6.4	Medium	2026-09-25
CVE-2026-93897	GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') CWE-79	6.4	Medium	2026-09-25
CVE-2026-19091	GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CWE-22	8.1	High	2026-08-11
CVE-2025-12833	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment CWE-639	4.3	Medium	2025-11-12
CVE-2024-13507	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection CWE-89	7.5	High	2025-07-26
CVE-2024-13506	GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter CWE-79	6.4	Medium	2025-02-11
CVE-2024-3732	GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode CWE-79	6.4	Medium	2024-04-23

All 10 known CVE vulnerabilities affecting GeoDirectory – WP Business Directory Plugin and Classified Listings Directory with full Chinese analysis, references, and POCs where available.