CVE-2026-66604 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting GeoDirectory versions up to 2.8.173. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with a base score of 7.1 (high). No known exploits in the wild have been reported. No patch or remediation information is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected GeoDirectory site, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability is exploitable without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads and limit exposure by restricting user input where possible.