GeoDirectory, a WordPress plugin for business and classified listings, contains a stored cross‑site scripting flaw. The bug stems from inadequate sanitization of the 'post_content' field and a lack of output escaping. An attacker who is authenticated with subscriber privileges or higher and who owns a published listing can inject malicious JavaScript that is saved and rendered whenever other users view the listing. This permits session theft, defacement, or malicious redirects, affecting the confidentiality, integrity, and availability of the site.

The vulnerability exists in all plugin releases up to and including version 2.8.191. Users running the GeoDirectory – WP Business Directory Plugin or Classified Listings Directory plugin from the vendor paoltaia should verify that they are not using these affected versions. Updating to any release newer than 2.8.191 eliminates the flaw.

The CVSS score of 6.4 indicates moderate severity. No EPSS data is provided, and the flaw is not listed in the CISA KEV catalog. The attack requires the victim to be a logged‑in subscriber or higher, and the payload must be embedded in a listing the attacker owns. Because the plugin’s ajax_save_post function restores the post_status, edits are applied immediately and do not trigger moderation, giving the attacker instant persistence. Given these conditions, the likelihood of exploitation in a typical deployment is lower than high‑profile remote code execution bugs, but it remains a concern for sites granting subscriber access to listing edits.