Threats tagged 'ghsa-ghfc-8854-87g3'

The GeoDirectory WordPress plugin (including WP Business Directory and Classified Listings Directory) up to version 2.8.199 is vulnerable to stored cross-site scripting (XSS) via the listing description field. This occurs due to insufficient sanitization of input on save combined with unsafe rendering of popover HTML content, allowing authenticated users with Subscriber-level access or higher to inject arbitrary scripts that execute when the affected page is viewed.