WordPress GeoDirectory Plugin Stored XSS and Privilege Escalation Vulnerability (CVE-2026-116752) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWordPress GeoDirectory – WP Business Directory Plugin versions up to, and including, 2.8.197
Authenticated attackers with subscriber-level access can execute arbitrary web scripts in the browser of an Administrator or Editor, leading to full site takeover
Immediately update the GeoDirectory plugin to the latest secure version (2.8.198 or higher)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Use WP-CLI to immediately update the GeoDirectory plugin to the latest patched version.
# Check and update the GeoDirectory plugin to the latest version
wp plugin update geodirectory --activate2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict listing submission privileges or deploy Web Application Firewall (WAF) rules to block script injection attempts in the post_images parameter. Below is an example of an Nginx configuration rule to block basic script tags.
# Block requests containing script tags in the URI or query parameters
if ($request_uri ~* "(<|%3C)script.*(>|%3E)") {
return 403;
}3. Log Audit & IoC Verification Commands
Run the following SQL query on your WordPress database to inspect stored metadata for potential malicious script payloads.
-- Query to detect stored XSS payloads in the post_images metadata
SELECT * FROM wp_postmeta
WHERE meta_key = 'post_images'
AND (meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%');Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-116752) exists in the GeoDirectory plugin for WordPress due to insufficient input sanitization and output escaping on the post_images parameter. Specifically, the vulnerability resides within the media and post data handling components (class-geodir-media.php, class-geodir-post-data.php), allowing authenticated attackers to inject malicious payloads that are permanently stored in the database.
2. Exploitation Mechanics & Attack Scenario
An attacker with low-privileged subscriber-level access can submit a business listing containing a malicious JavaScript payload within the post_images parameter. The payload does not execute in the attacker's browser session. Instead, it remains dormant until an Administrator or Editor opens the pending listing's edit screen as part of their routine editorial workflow. Upon viewing, the script executes within the context of the high-privileged user's browser, enabling session hijacking, unauthorized administrative actions, or privilege escalation.
3. Infrastructure & Business Impact
Successful exploitation of this vulnerability allows attackers to escalate privileges to the Administrator level. This can result in complete compromise of the WordPress instance, leading to unauthorized data exfiltration, deployment of malicious web shells, defacement, and significant reputational damage to the organization.
Official Vendor Advisories & References
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.
Frequently Asked SecOps Questions (CVE-2026-116752)
FAQQ1. How critical is CVE-2026-116752 and is it actively exploited in the wild?
CVE-2026-116752 is rated CVSS 6.4 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-116752?
Primary impacted vendors include ayecode across geodirectory. Scope summary: All versions of GeoDirectory – WP Business Directory Plugin up to, and including, 2.8.197
Q3. What temporary mitigations or workarounds exist for CVE-2026-116752 before patching?
[Mitigation] Immediately update the GeoDirectory plugin to the latest secure version (2.8.198 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-116752
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ayecode)
View Category →Microsoft Exchange Server Cross-Site Scripting (XSS) and Spoofing Vulnerability Advisory (CVE-2026-42897)
[Affected Scope] All supported on-premises Microsoft Exchange Server environments.
CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory
[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4
WordPress SureCart Plugin Stored XSS Vulnerability (CVE-2026-107653) Security Advisory
[Affected Scope] All versions up to, and including, 4.9.4 of the SureCart WordPress plugin
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.