The vulnerability is a stored XSS that arises because the GeoDirectory plugin does not sufficiently sanitize user‑supplied content in the listing description field (post_content). The plugin’s helper only neutralises certain data‑attributes, while WordPress core’s wp_kses_post still permits data‑attributes on standard tags. Additionally, the bundled AyeCode UI library initializes every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, injecting the attacker‑controlled data‑bs-content value as raw HTML into the popover body when it is rendered. Consequently, an authenticated user with Subscriber or higher privileges can inject arbitrary JavaScript that will execute in the browser of any visitor to the page containing the malicious listing. This leads to the compromise of confidentiality and integrity for end‑users, while the site’s own data remains untouched.

The GeoDirectory plugin for WordPress, developed by paoltaia and released as the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory, is vulnerable in all releases up to and including version 2.8.199. Only sites that allow authenticated users with Subscriber level or higher to edit listing content are impacted. Versions newer than 2.8.199 include the mitigation.

The CVSS score of 6.4 classifies this issue as medium severity. Although EPSS information is not available, and the vulnerability is not listed in CISA KEV, the requirement for authenticated access means that the attack surface is limited to users who can log on to the site. The exploitation path is straightforward: a compromised or willingly misbehaving Subscriber can edit a listing, insert malicious script into the post_content field, and once a visitor loads the page containing that listing, the injected code will run. The absence of a high exploitation probability score suggests that widespread exploitation is not yet observed, but the potential for session hijacking, credential theft, or phishing remains.