The GeoDirectory WordPress plugin is vulnerable to stored XSS when a text‑type custom field (such as a phone field) is populated by an authenticated user with subscriber-level access or higher. Insufficient input sanitization and inadequate output escaping allow a malicious actor to submit entity‑encoded script tags (e.g., <img src=x onerror=alert(1)>) through the AJAX geodir_save_post endpoint. The malicious payload is stored in the database and executed whenever a visitor loads a page containing the affected custom field, potentially enabling script injection that could compromise user sessions or deliver malware.

The vulnerability affects the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory by paoltaia. All released versions up to and including 2.8.181 are impacted; later releases are presumed not to contain the flaw.

The CVSS score of 6.4 categorizes this flaw as a medium‑severity vulnerability. The exploit requires an authenticated account with subscriber privileges or higher, limiting the attack surface to users who have certain levels of access to the plugin. No public EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation at this time. However, the stored XSS payload can affect all users who view any page displaying the compromised custom field, and thus the potential impact remains significant within affected sites.