Threats tagged 'ghsa-x6r7-w9f9-44fh'

CVE-2025-15677 is a stored cross-site scripting (XSS) vulnerability in the GeoDirectory WordPress plugin before version 2.8.110. It occurs because the plugin does not properly sanitize and escape a place-category setting before outputting it on an admin page. This allows users with high privileges, such as editors and above, to inject malicious scripts even if the unfiltered_html capability is disabled, for example in multisite WordPress setups.