The GeoDirectory plugin stores user‑supplied image titles without adequate sanitization or escaping. This flaw enables an authenticated attacker who can create or edit listings to insert malicious JavaScript into the title of an image. When a visitor loads a page containing that image, the injected script runs in the visitor’s browser context. The attack consequence is the ability for the attacker to execute code on the user’s behalf, which could include theft of session cookies, modification of page content, or other client‑side malicious actions. The description does not explicitly state the accepted outcome, impact described here is inferred from the nature of stored XSS flaws.

WordPress sites that have installed the paoltaia GeoDirectory – WP Business Directory Plugin (Classified Listings Directory) with any version up to and including 2.8.190 are affected. No other versions or products are listed as affected in the provided data.

The CVSS base score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low but non‑zero probability of exploitation in the wild. The vulnerability is not recorded in the CISA KEV catalog. Exploitation requires authentication and at least subscriber‑level privileges; the surface is limited to normal plugin usage such as uploading or editing media titles. The risk is moderate due to the need for credentials but the potential for malicious payload execution makes it significant for sites that trust subscriber users.