CVE-2026-96766 is a stored cross-site scripting vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. It affects all versions up to and including 2.8.183. The flaw exists because the 'business_hours' parameter is not properly sanitized or escaped, allowing authenticated users with subscriber-level privileges who own a listing to inject arbitrary scripts. The AJAX save handler only validates post authorship and a nonce without further capability checks, enabling exploitation by any subscriber-level user owning a listing. This vulnerability can lead to script execution in the context of users viewing the injected pages.

An attacker with subscriber-level access who owns a listing can inject malicious scripts via the 'business_hours' parameter. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), reflecting its network attack vector, low attack complexity, and impact on confidentiality and integrity but no impact on availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to listings. Avoid granting listing ownership to untrusted users. Follow vendor updates closely for an official fix.