WordPress Plugin Vulnerabilities

GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

Description

The plugin does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Proof of Concept

Affects Plugins

Plugin icon
geodirectory
Fixed in 2.8.110

References

CVE
CVE-2025-15677

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Krugov Artyom
Submitter
Krugov Aryom
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
bb6daced-3ee3-4ec7-a221-9981cd85285a

Timeline

Publicly Published
2026-07-28 (about 6 days ago)
Added
2026-07-28 (about 5 days ago)
Last Updated
2026-07-28 (about 5 days ago)

Other

Published
Title
Published
2012-01-01
Title
WP Live.php <= 1.2.1 - Cross-Site Scripting (XSS)
Published
2025-04-22
Title
Textmetrics < 3.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-03-27
Title
tagDiv Composer < 5.4 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'
Published
2025-09-22
Title
Passster < 4.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-09-29
Title
WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting