CVE-2026-107650: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

CVE-2026-107650 is a stored cross-site scripting vulnerability (CWE-79) in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw exists in the handling of the 'post_title' parameter, allowing authenticated attackers with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 2.8.190 due to inadequate input sanitization and output escaping.

An attacker with subscriber-level or higher access can inject malicious scripts into pages via the 'post_title' parameter. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or user session compromise. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to page content. Avoid granting unnecessary privileges to users and consider applying web application firewall rules to detect and block malicious script injections targeting the 'post_title' parameter.