WordPress Plugin Vulnerabilities | Page 16 | WPScan

0-9
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z

Slug

Published

2026-01-23

Title

GeoDirectory < 2.8.150 - Cross-Site Request Forgery

Slug

Published

2026-04-13

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.154 - Unauthenticated SQL Injection

Slug

Published

2026-05-13

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.158 - Missing Authorization

Slug

Published

2026-06-17

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.163 - Unauthenticated SQL Injection

Slug

Published

2026-06-30

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.162 - Authenticated (Subscriber+) Server-Side Request Forgery

Slug

Published

2026-07-27

Title

GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

Slug

Published

2026-07-28

Title

GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

Slug

Published

2026-08-03

Title

GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint

Slug

Published

2026-08-11

Title

GeoDirectory < 2.8.170 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

Slug

Published

2026-08-19

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.174 - Unauthenticated Stored Cross-Site Scripting

Slug

Published

2026-08-18

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.178 - Authenticated (Contributor+) Stored Cross-Site Scripting

Slug

Published

2026-08-26

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.177 - Cross-Site Request Forgery

Slug

Published

2026-09-02

Title

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.175 - Unauthenticated SQL Injection

Slug

Published

2026-10-13

Title

GeoDirectory < 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title

Slug

Published

2026-10-13

Title

GeoDirectory < 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

Slug

Published

2026-09-24

Title

GeoDirectory < 2.8.182 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')

Slug

Published

2026-09-24

Title

GeoDirectory < 2.8.184 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

Slug

Published

2026-10-02

Title

GeoDirectory < 2.8.187 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

Slug

Published

2026-10-09

Title

GeoDirectory < 2.8.189 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

Slug

Published

2026-10-09

Title

GeoDirectory < 2.8.188 - Unauthenticated Local File Inclusion via 'design_type' Parameter

Slug

Published

2026-10-15

Title

GeoDirectory < 2.8.193 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field

Slug

Published

2026-10-15

Title

GeoDirectory < 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute

Slug

Published

2026-10-22

Title

GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export

Slug

Published

2026-10-30

Title

GeoDirectory < 2.8.199 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

Slug

Published

2026-10-22

Title

GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR