PLUGIN SECURITY
Is Geodirectory safe?
A superb WordPress Business Directory plugin to create a local business directory, classified ads directory, or job listings board.
What this plugin does
- Slug:
geodirectory - Author: Paolo
- 10000+ active installs
- 96/100 rating (716 reviews on wordpress.org)
- 2689134 all-time downloads
- On WordPress.org since 2014-04-21
business directoryclassifiedsdirectorydirectory pluginlistings
Maintenance status
- Last updated: 2026-11-12 4:30pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.6+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
51 known CVEs on file for Geodirectory.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-124250 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.203 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.8.203 | 2.8.203 | 2026-11-06 | — |
| CVE-2026-119113 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.200 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.200 | 2.8.200 | 2026-10-30 | — |
| CVE-2026-118635 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.199 | Improper Control of Generation of Code ('Code Injection') | Medium 6.5 | < 2.8.199 | 2.8.199 | 2026-10-30 | — |
| CVE-2026-116752 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.198 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.198 | 2.8.198 | 2026-10-30 | — |
| CVE-2026-120082 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.201 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.8.201 | 2.8.201 | 2026-10-30 | — |
| CVE-2026-114270 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.197 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 2.8.197 | 2.8.197 | 2026-10-29 | — |
| CVE-2026-113494 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.195 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 2.8.195 | 2.8.195 | 2026-10-28 | — |
| CVE-2026-113488 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.196 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.8.196 | 2.8.196 | 2026-10-28 | — |
+ 50 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-113487 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.196 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.8.196 | 2.8.196 | 2026-10-28 | — |
| CVE-2026-113491 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 6.4 | < 2.8.194 | 2.8.194 | 2026-10-24 | — |
| CVE-2026-113674 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Improper Access Control | Low 3.7 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-113673 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Improper Control of Generation of Code ('Code Injection') | High 7.2 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-113493 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.8 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-113492 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-113490 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-113489 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.194 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 2.8.194 | 2.8.194 | 2026-10-22 | — |
| CVE-2026-110703 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.192 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.192 | 2.8.192 | 2026-10-15 | — |
| CVE-2026-111069 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.193 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.193 | 2.8.193 | 2026-10-15 | — |
| CVE-2026-107754 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.191 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.191 | 2.8.191 | 2026-10-13 | — |
| CVE-2026-107650 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.191 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.191 | 2.8.191 | 2026-10-13 | — |
| CVE-2026-104993 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.189 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.189 | 2.8.189 | 2026-10-09 | — |
| CVE-2026-104899 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.188 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 8.1 | < 2.8.188 | 2.8.188 | 2026-10-09 | — |
| CVE-2026-93897 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.182 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.182 | 2.8.182 | 2026-09-24 | — |
| CVE-2026-96766 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.184 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.184 | 2.8.184 | 2026-09-24 | — |
| CVE-2026-103913 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.187 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 2.8.187 | 2.8.187 | 2026-09-24 | — |
| CVE-2026-84813 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.175 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 2.8.175 | 2.8.175 | 2026-08-26 | — |
| CVE-2026-66604 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.174 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.8.174 | 2.8.174 | 2026-08-20 | — |
| CVE-2026-81271 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.177 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.8.177 | 2.8.177 | 2026-08-19 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.178 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.8.178 | 2.8.178 | 2026-08-18 | — |
| CVE-2026-19091 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.170 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 8.1 | < 2.8.170 | 2.8.170 | 2026-08-11 | — |
| CVE-2026-16988 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.169 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 2.8.169 | 2.8.169 | 2026-08-09 | — |
| CVE-2026-16968 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.168 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 2.8.168 | 2.8.168 | 2026-08-05 | — |
| CVE-2025-15677 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.110 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.8.110 | 2.8.110 | 2026-07-28 | — |
| CVE-2026-57681 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.162 | Server-Side Request Forgery (SSRF) | Medium 6.4 | < 2.8.162 | 2.8.162 | 2026-06-30 | — |
| CVE-2026-54831 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.163 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 2.8.163 | 2.8.163 | 2026-06-17 | — |
| CVE-2026-42671 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.158 | Missing Authorization | Medium 6.5 | < 2.8.158 | 2.8.158 | 2026-05-13 | — |
| CVE-2026-39512 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.154 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 2.8.154 | 2.8.154 | 2026-04-13 | — |
| CVE-2026-24549 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.150 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 2.8.150 | 2.8.150 | 2026-01-23 | — |
| CVE-2025-12833 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.140 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 2.8.140 | 2.8.140 | 2025-11-11 | — |
| CVE-2024-13506 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.98 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.98 | 2.8.98 | 2025-02-10 | — |
| CVE-2024-13507 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.98 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 2.8.98 | 2.8.98 | 2025-01-29 | — |
| CVE-2024-56259 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.85 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.3.85 | 2.3.85 | 2024-12-30 | — |
| CVE-2024-50437 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.81 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.3.81 | 2.3.81 | 2024-10-24 | — |
| CVE-2024-43981 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.71 | Missing Authorization | High 8.8 | < 2.3.71 | 2.3.71 | 2024-08-28 | — |
| CVE-2024-43145 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.62 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 2.3.62 | 2.3.62 | 2024-08-07 | — |
| CVE-2024-3732 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.49 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.3.49 | 2.3.49 | 2024-04-22 | — |
| CVE-2023-50845 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.6 | < 2.3.29 | 2.3.29 | 2023-12-21 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.29 | — | Unknown | < 2.3.29 | 2.3.29 | 2023-10-18 | — |
| CVE-2023-0278 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.2.24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 2.2.24 | 2.2.24 | 2023-01-31 | — |
| CVE-2022-4775 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.2.22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.2.22 | 2.2.22 | 2022-12-29 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.2.20 | — | Unknown | < 2.2.20 | 2.2.20 | 2022-12-21 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.2.20 | — | Unknown | < 2.2.20 | 2.2.20 | 2022-12-20 | — |
| CVE-2021-24720 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.1.1.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.1.3 | 2.1.1.3 | 2021-09-02 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.8.120 | — | Medium 5.9 | < 2.8.120 | 2.8.120 | 0000-00-00 | — |
| — | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory] < 2.3.29 | — | Unknown | < 2.3.29 | 2.3.29 | — | — |
| — | GeoDirectory < 2.3.29 - Authenticated (Administrator+) SQL Injection via orderby | — | Unknown | < 2.3.29 | 2.3.29 | — | — |
| CVE-2025-6200 | GeoDirectory < 2.8.120 - Contributor+ Stored XSS | — | Unknown | < 2.8.120 | 2.8.120 | — | — |
| CVE-2026-68565 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.178 - Authenticated (Contributor+) Stored Cross-Site Scripting | — | Unknown | < 2.8.178 | 2.8.178 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Directorist: AI-Powered Business Directory, Listings & Classified Ads — 20000+ active installs — 92/100 (698) — max PHP 8.4
- HivePress – Business Directory, Listings & Classified Ads Plugin — 10000+ active installs — 98/100 (222) — max PHP 8.4
- Business Directory Plugin – Easy Listing & Member Directories for WordPress — 10000+ active installs — 92/100 (504) — max PHP 8.4
- Motors – Car Dealership & Classified Listings Plugin — 9000+ active installs — 90/100 (79)
- Classified Listing – AI-Powered Classified ads & Business Directory — 8000+ active installs — 96/100 (138)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.