Description
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Published: 2026-08-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated Cross Site Scripting (XSS) exists in GeoDirectory plugin versions up to 2.8.173 for WordPress. This flaw allows an attacker to inject malicious scripts that are executed in the browsers of site visitors. The weakness is a classic reflected or stored XSS issue as identified by CWE-79.

Affected Systems

The vulnerable product is the WordPress GeoDirectory plugin (Paolo:GeoDirectory) with affected releases up to and including 2.8.173. All installations running these or earlier versions are susceptible, regardless of the WordPress core version or hosting environment.

Risk and Exploitability

The CVSS score of 7.1 indicates medium to high severity, and the vulnerability can be exploited without any authentication, relying solely on a victim's browser interaction. EPSS data is not available. The vulnerability is not listed in CISA KEV, indicating no current evidence of widespread exploitation.

Generated by OpenCVE AI on August 20, 2026 at 21:47 UTC.

Remediation

Vendor Solution

Update the WordPress GeoDirectory Plugin to the latest available version (at least 2.8.174).

OpenCVE Recommended Actions

  • Update the GeoDirectory plugin to version 2.8.174 or later, which removes the XSS vector
  • If an immediate update is not possible, apply content sanitization to all input fields that forward user data to the page, ensuring that scripting tags are escaped or removed
  • Deploy a web application firewall or enable the WordPress "XSS Filter" settings to block malicious scripts before they reach end‑users

Generated by OpenCVE AI on August 20, 2026 at 21:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Paolo
Paolo geodirectory
Wordpress
Wordpress wordpress
Vendors & Products Paolo
Paolo geodirectory
Wordpress
Wordpress wordpress

Thu, 20 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Title WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Paolo Geodirectory
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-20T16:01:18.671Z

Reserved: 2026-07-27T14:00:13.421Z

Link: CVE-2026-66604

cve-icon Vulnrichment

Updated: 2026-08-20T16:01:12.225Z

cve-icon NVD

Status : Deferred

Published: 2026-08-20T12:16:34.063

Modified: 2026-08-20T16:17:43.847

Link: CVE-2026-66604

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T22:00:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')