The GeoDirectory WordPress plugin versions prior to 2.8.110 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a place-category setting. This vulnerability enables high-privilege users (editors and above) to execute stored Cross-Site Scripting attacks on admin pages, bypassing restrictions like the disallowance of the unfiltered_html capability. No CVSS score or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows high-privilege users to inject and execute arbitrary JavaScript in the context of the WordPress admin interface. This could lead to session hijacking, privilege escalation, or other malicious actions within the admin environment. However, exploitation requires already having elevated privileges (editor or higher).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access to trusted individuals only and monitor for suspicious activity. Avoid granting editor or higher roles to untrusted users. Follow the vendor's official updates for a patch release.