The vulnerability arises because GeoDirectory fails to sanitize and escape the value of a place-category setting before rendering it in an administrative page. This omission permits authenticated users with the editor role or higher to embed arbitrary HTML, JavaScript, or other payloads into that setting. When these malicious contents are later served within the WordPress admin interface, the injected script executes in the context of the logged-in administrator, potentially stealing session cookies, performing credential theft, or hijacking the administrative session.

All versions of the GeoDirectory WordPress plugin older than 2.8.110 contain the flaw. The vulnerability is tied to the plugin’s place-category configuration feature, and it affects any WordPress environment where GeoDirectory is installed, including multisite setups that have unfiltered_html disabled for editors.

Because the flaw requires authenticated, high-privilege users, the immediate exploitability is limited to those who can be authenticated as editor or higher. The CVSS score of 3.5 indicates a low severity vulnerability. The EPSS score of < 1% suggests a very low but non‑zero probability of exploitation. The lack of a public exploit does not alter the risk assessment, but the impact for targeted administrators remains severe. There is no CISA KEV listing, yet the ability of editors to bypass the unfiltered_html restriction means that all installations using the plugin should prioritize patching.