CyberSecBulletin

GeoDirectory vulnerabilities

We track 2 vulnerabilities in GeoDirectory products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest GeoDirectory vulnerabilities

  • 7.2 High severity

    GeoDirectory: Improper Control of Generation of Code

    CVE-2026-113673GeoDirectory

    The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot

  • 7.5 High severity

    GeoDirectory: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-16988GeoDirectory

    The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pendin