CVE-2025-15677 — GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users…
Published: 2026-08-05 · CVSS: 3.5 · CVSS 3.1
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7