Paoltaia vulnerabilities
We track 5 vulnerabilities in Paoltaia products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest Paoltaia vulnerabilities
- 7.2 High severity
GeoDirectory – WP Business Directory Plugin…: Improper Neutralization of Input During Web Page Generation
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.200 due to insufficient input sanitiz
- 8.1 High severity
GeoDirectory – WP Business Directory Plugin…: Improper Control of Filename for Include/Require Statement in PHP Program
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for una
- 7.5 High severity
GeoDirectory – WP Business Directory Plugin…: Improper Neutralization of Special Elements used in an SQL Command
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate
- 8.1 High severity
GeoDirectory – WP Business Directory Plugin…: Improper Limitation of a Pathname to a Restricted Directory
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.1
- 7.5 High severity
GeoDirectory – WP Business Directory Plugin…: Improper Neutralization of Special Elements used in an SQL Command
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user suppli