The GeoDirectory WordPress plugin versions prior to 2.8.110 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a place-category setting. This vulnerability enables high-privilege users (editors and above) to inject and execute malicious scripts in the admin interface, bypassing restrictions like the absence of the unfiltered_html capability. The vulnerability is identified as CVE-2025-15677 with a CVSS v3.1 base score of 3.5, indicating low severity. No official remediation or patch information is currently available from the vendor or advisory sources.

An attacker with editor or higher privileges can exploit this vulnerability to perform stored cross-site scripting attacks within the WordPress admin interface. This could lead to limited confidentiality and integrity impacts, such as executing arbitrary scripts in the context of the admin user. However, the impact is limited by the requirement for high privileges and user interaction, and the CVSS score reflects a low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access to trusted individuals only and monitor for suspicious activity. Avoid granting editor or higher roles to untrusted users. Follow the vendor's updates for an official fix or temporary mitigation.