Threats tagged 'ghsa-pv48-453p-9559'

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content' parameter. This affects all versions up to and including 2.8.200. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The attack bypasses the plugin's shortcode filtering due to a nested shortcode payload and limitations in WordPress's strip_shortcodes() function and kses HTML filtering.