The GeoDirectory plugin for WordPress stores custom field values in the database without proper server‑side sanitization or escaping. An authenticated user with subscriber‑level or higher privileges can submit crafted data for the "twitterusername" field that breaks out of the HTML attribute context and stores a payload directly. When any visitor loads a page containing the malicious field, the browser processes the injected script, creating an opportunity for session hijacking, defacement, or delivery of malware. The weakness is defined as an improper output encoding (CWE‑79).

WordPress sites that have installed the paoltaia:GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin, version 2.8.192 or earlier. Any user with a subscriber or higher role on that site can exploit the flaw. Versions newer than 2.8.192 are not affected. If the plugin is absent or a later version is in use, the vulnerability does not exist.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of 0.00221 (<1%) indicates a very low but non‑zero probability of exploitation. Exploitation requires discovery of valid subscriber credentials or legitimate subscription access; once an attacker injects the payload, it is stored server‑side and will run for every page viewer. The risk thus depends on the attacker’s ability to obtain subscriber rights and the site’s level of user traffic. Above all, the attack vector is authenticated; a passive or unauthenticated visitor cannot initiate the injection.