CVE-2026-104993: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

CVE-2026-104993 is a stored cross-site scripting vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'email (Contact Email custom field htmlvar_name)' parameter. Authenticated attackers with subscriber-level privileges or above can inject arbitrary web scripts into listing pages. Successful exploitation depends on the administrator enabling the Contact Email custom field on public single-listing pages and approving the attacker's submitted listing, allowing the malicious script to execute in the context of users viewing the page.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into listing pages, potentially leading to information disclosure or user session compromise when other users access the affected pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or not using the Contact Email custom field on public listing pages or restrict listing approvals to trusted users only to reduce risk. Monitoring for suspicious listings and limiting subscriber privileges may also help mitigate exploitation.