Paolo vulnerabilities and threats

11 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.3	EPSS 0.4%	CVE-2026-84813GeoDirectory (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-09-03CVE Database V5CVE-2026-84813 Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. EPSS 0.4%Vulnerability Paolo CWE-89	CVE Database V5	2026-09-03
High	8.8	EPSS 0.2%	CVE-2026-81271GeoDirectory (WordPress plugin) · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.2%2026-08-27CVE Database V5CVE-2026-81271 CVE-2026-81271 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting GeoDirectory versions up to 2.8.176. It allows unauthenticated attackers to perform unauthorized actions by tricking users into submitting unwanted requests. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and apply fixes once released. EPSS 0.2%Vulnerability Paolo CWE-352	CVE Database V5	2026-08-27
High	7.1	EPSS 0.3%	CVE-2026-66604GeoDirectory (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2026-08-20CVE Database V5CVE-2026-66604 CVE-2026-66604 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting GeoDirectory versions up to and including 2.8.173. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation due to improper input neutralization. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. EPSS 0.3%Vulnerability Paolo CWE-79	CVE Database V5	2026-08-20
Medium	6.5	EPSS 0.2%	CVE-2026-68565GeoDirectory (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-08-18CVE Database V5CVE-2026-68565 Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. EPSS 0.2%Vulnerability Paolo CWE-79	CVE Database V5	2026-08-18
Medium	6.4	EPSS 0.2%	CVE-2026-57681GeoDirectory (WordPress plugin) · Server-Side Request Forgery (SSRF) Medium6.4EPSS 0.2%2026-07-02CVE Database V5CVE-2026-57681 Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions. EPSS 0.2%Vulnerability Paolo CWE-918	CVE Database V5	2026-07-02
Critical	9.3	EPSS 0.4%	CVE-2026-54831GeoDirectory (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-06-26CVE Database V5CVE-2026-54831 Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. EPSS 0.4%Vulnerability Paolo CWE-89	CVE Database V5	2026-06-26
Critical	9.3	EPSS 0.3%	CVE-2026-39512GeoDirectory (WordPress plugin) · SQL Injection Critical9.3EPSS 0.3%2026-06-15CVE Database V5CVE-2026-39512 CVE-2026-39512 is a critical unauthenticated SQL Injection vulnerability in Paolo GeoDirectory versions up to and including 2.8.152. This vulnerability allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor. EPSS 0.3%Vulnerability Paolo CWE-89	CVE Database V5	2026-06-15
Medium	6.5	EPSS 0.2%	CVE-2026-42671GeoDirectory (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.2%2026-06-01CVE Database V5CVE-2026-42671 Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157. EPSS 0.2%Vulnerability Paolo CWE-862	CVE Database V5	2026-06-01
Medium	4.3	EPSS 0.2%	CVE-2026-24549GeoDirectory (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.2%2026-01-23CVE Database V5CVE-2026-24549 Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.149. EPSS 0.2%Vulnerability Paolo	CVE Database V5	2026-01-23
Medium	6.5	EPSS 0.3%	CVE-2024-56259GeoDirectory (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.3%2025-01-02CVE Database V5CVE-2024-56259 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.84. EPSS 0.3%Vulnerability Paolo	CVE Database V5	2025-01-02
Medium	6.5	EPSS 0.3%	CVE-2024-50437GeoDirectory (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.3%2024-10-28CVE Database V5CVE-2024-50437 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80. EPSS 0.3%Vulnerability Paolo	CVE Database V5	2024-10-28

Page 1 of 1