CVE-2026-111069: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

CVE-2026-111069 is a stored cross-site scripting vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory WordPress plugin. The flaw exists in the handling of the 'twitterusername' parameter, where insufficient server-side input sanitization and output escaping allow an authenticated user with subscriber-level access or above to inject arbitrary scripts. The client-side HTML pattern attribute restricting input to alphanumeric characters is not validated on the server, enabling attackers to submit attribute-breakout payloads that are stored in the custom field table and executed when the page is viewed.

An attacker with subscriber-level access can inject malicious JavaScript code into pages via the 'twitterusername' field. This script executes in the context of users viewing the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently available as per the provided data. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict subscriber-level user capabilities if possible and consider applying web application firewall (WAF) rules to detect and block malicious payloads targeting the 'twitterusername' parameter. Avoid granting unnecessary subscriber-level access and educate users about the risk of malicious input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.