The vulnerability arises because GeoDirectory fails to sanitize and escape the value of a place-category setting before rendering it in an administrative page. This omission permits authenticated users with the editor role or higher to embed arbitrary HTML, JavaScript, or other payloads into that setting. When these malicious contents are later served within the WordPress admin interface, the injected script executes in the context of the logged‑in administrator, potentially stealing session cookies, performing credential theft, or hijacking the administrative session.

All versions of the GeoDirectory WordPress plugin older than 2.8.110 contain the flaw. The vulnerability is tied to the plugin’s place-category configuration feature, and it affects any WordPress environment where GeoDirectory is installed, including multisite setups that have unfiltered_html disabled for editors.

Because the flaw requires authenticated, high‑privilege users, the immediate exploitability is limited to those who can be authenticated as editor or higher. The absence of a public exploit and the lack of an EPSS score suggest that exploitation likelihood is not high yet, but the impact for targeted administrators is severe. There is no CISA KEV listing, but the fact that editors can bypass the unfiltered_html restriction means that all sites using the plugin should prioritize patching.