| 2026-10-22 |
WPSEC-2026-1463 |
GeoDirectory <= 2.8.194 - Authenticated (Subscriber+) Missing Authorization to Listing Status, Featured Flag, Expiry and Package Modification |
Medium 4.3 |
2.8.195 |
| 2026-10-22 |
WPSEC-2026-1462 |
GeoDirectory <= 2.8.194 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Badge Shortcode 'cta' and 'link' Attributes |
Medium 6.4 |
2.8.195 |
| 2026-10-21 |
WPSEC-2026-1391 |
GeoDirectory <= 2.8.193 - Unauthenticated Authorization Bypass to Guest Listing Ownership |
Medium 5.6 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1390 |
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media |
High 7.6 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1389 |
GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference to Listing Attachment Modification |
Medium 4.3 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1388 |
GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings |
Medium 5.3 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1387 |
GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map and Post Badge Shortcode Attributes |
Medium 6.4 |
2.8.194 |
| 2026-10-16 |
WPSEC-2026-1107 |
GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via X/Twitter Username Custom Field |
Medium 6.4 |
2.8.193 |
| 2026-10-12 |
WPSEC-2026-0788 |
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Custom Field Values in Dynamic Content Variables |
Medium 4.9 |
2.8.191 |
| 2026-10-06 |
WPSEC-2026-0468 |
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Email Custom Field |
Medium 5.4 |
2.8.189 |
| 2026-10-03 |
WPSEC-2026-0379 |
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter |
Critical 9.8 |
2.8.188 |
| 2026-10-02 |
WPSEC-2026-0348 |
GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) SQL Injection via Listing Latitude and Longitude |
Medium 6.5 |
2.8.187 |
| 2026-10-02 |
WPSEC-2026-0347 |
GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Latitude and Longitude |
Medium 5.4 |
2.8.187 |
| 2026-10-02 |
WPSEC-2026-0307 |
GeoDirectory <= 2.8.182 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Custom Field Link Label |
Medium 6.4 |
2.8.183 |
