The vulnerability in the GeoDirectory – WP Business Directory Plugin allows an authenticated attacker with subscriber-level or higher privileges to inject arbitrary JavaScript into the 'post_content' field. The injected script is stored and rendered when other users view the listing, leading to client‑side code execution on visitor browsers. The defect results from insufficient input sanitization and lack of output escaping, which permits the persistence of malicious payloads without triggering moderation. The impact is restricted to compromised listings created by the attacker, causing the injected code to run automatically for any site visitor who views the affected listings.

This flaw is present in all versions of the GeoDirectory plugin up to and including 2.8.191, as released by the vendor paoltaia. Users of the WordPress plugin “GeoDirectory – WP Business Directory Plugin and Classified Listings Directory” running any affected version should verify their installed version and plan an upgrade.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is reported as less than 1 %, suggesting a low to very low likelihood of exploitation in current datasets, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker own a published listing and possess subscriber‑level access, after which the ajax_save_post function re‑applies the existing post_status so the payload remains live immediately. Given these prerequisites, the scope is limited to authenticated listing owners, and the overall risk to a typical deployment is moderate rather than critical.