CVE-2025-15677 GeoDirectory CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining and securing WordPress installations using the GeoDirectory plugin, especially in multisite setups, should assess exposure and prioritize remediation. These teams should verify plugin versions, update to 2.8.110 or later if necessary, and monitor for suspicious activity.

Why it matters

CVE-2025-15677 is a Stored Cross-Site Scripting vulnerability in the GeoDirectory WordPress plugin. It allows high-privilege users to perform XSS attacks in admin pages, even when the unfiltered_html capability is disallowed. WordPress administrators and security teams should assess exposure and prioritize remediation, especially in multisite setups.

• Potential for Stored Cross-Site Scripting attacks in WordPress admin pages.
• Possible impact on high-privilege users such as editors and above.
• Need for verification of plugin version and update to 2.8.110 or later if necessary.

Technical summary

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. This vulnerability allows attackers to inject malicious scripts into admin pages, potentially leading to unauthorized actions or data breaches. The vulnerability is a Stored Cross-Site Scripting (XSS) vulnerability.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the GeoDirectory plugin, especially in multisite setups.

Recommended defensive actions

• Assess exposure and prioritize remediation for WordPress installations using the GeoDirectory plugin, especially in multisite setups.
• Verify plugin version and update to 2.8.110 or later if necessary.
• Monitor for suspicious activity and implement compensating controls to prevent exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability description explicitly names the GeoDirectory WordPress plugin and the WPScan advisory identifies GeoDirectory as the vendor. Evidence is based on CVE and NVD records, with additional details from WPScan. The CVE record was published on 2026-08-05T07:16:33.493Z and has not been modified since then. Defenders should verify plugin versions and update to 2.8.110 or later if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.