GeoDirectory WordPress plugin flagged with arbitrary shortcode execution flaw (EUVD-2026-114219)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- paoltaia
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- First seen
Summary
The EUVD entry EUVD-2026-114219, relayed via a Mastodon post, lists a CVSS v3.1 score of 6.5 for the GeoDirectory plugin. The entry says the plugin allows arbitrary shortcode execution in the affected versions, which are cut off in the feed.
If you use paoltaia
Update GeoDirectory to the latest version once the vendor's fix is confirmed
Check the EUVD entry for the exact affected version range
Review pages and listings for unexpected shortcode output
Update GeoDirectory to the latest fixed version once available
Review listing descriptions for injected scripts
What the sources say 2
· Mastodon: “The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_con” Source
· Mastodon: “The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and incl” Source