The GeoDirectory WP Business Directory plugin is vulnerable to a stored Cross‑Site Scripting flaw that allows authenticated users with subscriber‑level access and higher to inject arbitrary JavaScript into the post_title field. Because the title is output without proper sanitization or escaping, the injected script is rendered and executed whenever any user visits the affected listing page. This can lead to session hijacking, credential theft, defacement or other malicious activity on the website’s visitors.

The vulnerability affects the GeoDirectory plugin from the paoltaia vendor, affecting all WordPress installations that use versions up to and including 2.8.190. Any site that has not upgraded beyond 2.8.190 is potentially exposed.

The CVSS score of 6.4 classifies the flaw as medium severity. The EPSS score is below 1%, indicating that the likelihood of widespread exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only legitimate subscriber‑level access—a status that many sites grant to a broad group of users—the vector is readily available to attackers who can edit listing titles. Once injected, the payload will execute in the browsers of all visitors who view the compromised listing. The overall risk remains moderate but warrants prompt attention.