The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the display_name profile parameter. This allows authenticated attackers with at least Subscriber privileges to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 2.8.97. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change. No patch or remediation details are available from the vendor or advisory.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to inject and store malicious scripts that execute in the browsers of other users who visit the affected pages. This can lead to unauthorized disclosure of information and modification of data within the application context. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and consider disabling or limiting use of the display_name profile parameter if possible. Monitor for updates from the plugin vendor and apply patches promptly once released.