CVE-2026-110703: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

CVE-2026-110703 is a stored cross-site scripting vulnerability (CWE-79) in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress. It affects all versions up to 2.8.191. The flaw exists because the 'post_content' parameter is not properly sanitized or escaped, enabling authenticated users with subscriber-level privileges or higher who own a listing to inject arbitrary web scripts. The ownership check limits injection to listing owners, but the ajax_save_post() function re-applies the existing post status, allowing edits to published listings to bypass re-moderation and remain live immediately. This vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity.

An attacker with subscriber-level access or higher who owns a published listing can inject malicious scripts into the 'post_content' field. These scripts execute in the context of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. Because edits to published listings bypass re-moderation, the malicious content becomes live immediately without review. There is no indication of impact on availability or server integrity.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level users from publishing or editing listings if possible, and monitor for suspicious content in listings. Consider applying manual content sanitization or using security plugins that can detect and block XSS payloads.