Technical impact
The vulnerability in AyeCode Ltd GeoDirectory allows attackers to inject malicious scripts that are stored in the application and executed later when users view the affected pages. This type of flaw, classified as CWE‑79, can lead to theft of session cookies, defacement of content, or the execution of arbitrary client‑side code in the context of the user’s browser. While it does not provide direct access to server‑side data, the impact on confidentiality, integrity, and availability of the site can be significant if an attacker is able to target privileged users or adversely influence user trust.
Affected Systems
GeoDirectory plugins for WordPress versions up through 2.8.204 are affected. The vendor is AyeCode Ltd, and all installations of GeoDirectory within that version range should be inspected and assessed. The latest reliable fix is available in version 2.8.205 and newer.
Risk and Exploitability
The CVSS base score of 6.5 indicates moderate severity. The EPSS score is currently unavailable, so the exact likelihood of exploitation cannot be quantified; however, because the flaw is a stored XSS, it can be triggered through legitimate user interactions such as creating listings or leaving comments, making it relatively easy for unauthenticated or low‑privilege attackers to exercise the exploit. The vulnerability is not listed in the CISA KEV catalog, but the nature of XSS can still lead to widespread damage if the site hosts sensitive user data or financial transactions. The most likely attack vector is through the web interface where user‑generated content is accepted and rendered without proper sanitization, and the attacker would need to craft input containing malicious script tags that are then executed by other visitors' browsers.
