Plugin icon

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

geodirectory

Vulnerabilities:

15

Last Updated:

April 2, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-01-23
Title
GeoDirectory < 2.8.150 - Cross-Site Request Forgery
Fixed in
Fixed in 2.8.150
CVSS
4.3 (medium)
Published
2025-11-11
Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.140 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Fixed in
Fixed in 2.8.140
CVSS
4.3 (medium)
Published
2025-06-20
Title
GeoDirectory < 2.8.120 - Contributor+ Stored XSS
Fixed in
Fixed in 2.8.120
CVSS
5.9 (medium)
Published
2025-02-10
Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.98 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter
Fixed in
Fixed in 2.8.98
CVSS
6.4 (medium)
Published
2025-01-29
Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.98 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.8.98
CVSS
7.5 (high)
Published
2024-12-30
Title
GeoDirectory < 2.3.85 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.3.85
CVSS
6.4 (medium)
Published
2024-10-24
Title
GeoDirectory < 2.3.81 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.3.81
CVSS
6.4 (medium)
Published
2024-08-28
Title
GeoDirectory < 2.3.71 - Missing Authorization via geodirectory_rated()
Fixed in
Fixed in 2.3.71
CVSS
4.3 (medium)
Published
2024-08-07
Title
GeoDirectory < 2.3.62 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 2.3.62
CVSS
9.9 (critical)
Published
2024-04-22
Title
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory < 2.3.49 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode
Fixed in
Fixed in 2.3.49
CVSS
6.4 (medium)
Published
2023-12-21
Title
GeoDirectory < 2.3.29 - Authenticated(Administrator+) SQL Injection
Fixed in
Fixed in 2.3.29
CVSS
6.6 (medium)
Published
2023-10-18
Title
GeoDirectory < 2.3.29 - Authenticated (Administrator+) SQL Injection via orderby
Fixed in
Fixed in 2.3.29
CVSS
7.2 (high)
Published
2023-01-31
Title
GeoDirectory < 2.2.24 - Admin+ SQLi
Fixed in
Fixed in 2.2.24
CVSS
6.8 (medium)
Published
2022-12-29
Title
GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 2.2.22
CVSS
6.8 (medium)
Published
2021-09-02
Title
GeoDirectory < 2.1.1.3 - Authenticated (admin+) Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.1.1.3
CVSS
4.8 (medium)