CVE-2026-93897 is a stored cross-site scripting vulnerability (CWE-79) in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress. It affects all versions up to and including 2.8.181. The flaw allows authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts into text-type custom fields via the AJAX geodir_save_post endpoint. The injection bypasses the strpos()-based tag-stripping mechanism by using entity-encoded angle brackets, leading to script execution in the context of any user accessing the injected page.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users viewing the injected pages. This can result in information disclosure and limited integrity impact. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact. There is no indication of availability impact or known exploits in the wild.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict subscriber-level user permissions where possible and avoid using text-type custom fields for untrusted input. Validate and sanitize inputs at the application level as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.