Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: AyeCode Ltd Component: Geodirectory Clear all filters
TI-2025-05608 CVE-2025-6200 · GHSA-987q-rh8g-5x3f

GeoDirectory < 2.8.120 - Contributor+ Stored XSS

Priority MEDIUM 60

The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the con…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00245 Published 2025-07-11 Fixed in 2.8.120 CWE-79
TI-2024-37229 CVE-2024-56259 · GHSA-j5xx-pcvm-w86j

WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.84.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00336 Published 2025-01-02 No fix listed CWE-79
TI-2024-29570 CVE-2024-43981 · GHSA-q2v5-68x7-3p6j

WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00423 Published 2024-11-01 No fix listed CWE-862
TI-2024-33870 CVE-2024-50437 · GHSA-pf42-pfjx-4fv8

WordPress GeoDirectory plugin <= 2.3.80 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-10-28 No fix listed CWE-79
TI-2024-28816 CVE-2024-43145 · GHSA-fhjf-8266-gqfg

WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerability

Priority HIGH 71

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00441 Published 2024-08-18 No fix listed CWE-89
TI-2024-03478 CVE-2024-3732 · GHSA-c8v3-wvcw-2g23

Cross-site scripting in paoltaia GeoDirectory – WP Business Directory Plugin and…

Priority LOW 28

The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and inc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2024-04-23 No fix listed CWE-79
TI-2023-27750 CVE-2023-50845 · GHSA-f9c3-v8hj-gm62

WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Direc…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00541 Published 2023-12-28 No fix listed CWE-89
TI-2022-04371 CVE-2022-4775 · GHSA-45j5-wmmf-563x

GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode

Priority HIGH 66

The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 2.2.22