CVE-2026-104993 paoltaia CVE debrief

Who should care

WordPress administrators, security teams, and users with subscriber-level access or higher in installations using the GeoDirectory plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-104993 is a Stored Cross-Site Scripting vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. It allows authenticated attackers with subscriber-level access to inject arbitrary web scripts, potentially leading to security issues. WordPress administrators and security teams should assess exposure and prioritize remediation.

• Assess exposure and prioritize remediation for WordPress installations using the GeoDirectory plugin.
• Verify that the plugin version is not 2.8.188 or lower to prevent potential XSS attacks.
• Monitor for suspicious activity or injected scripts on the public single-listing output page.
• Consider upgrading to a patched version or applying compensating controls to mitigate the vulnerability.

Technical summary

The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject arbitrary web scripts. The vulnerability requires an administrator to have added and configured the Contact Email custom field to render on the public single-listing output page. Successful exploitation can lead to security issues, including potential script injection on the public single-listing output page.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the GeoDirectory plugin, especially those with subscriber-level access or higher.

Recommended defensive actions

• Assess exposure by checking if the GeoDirectory plugin is installed and if the Contact Email custom field is in use.
• Verify that the plugin version is not 2.8.188 or lower.
• Consider upgrading to a patched version or applying compensating controls.
• Monitor for suspicious activity or injected scripts on the public single-listing output page.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and parameters. However, additional information on exploitation or impact is limited. Defenders should verify the plugin version and configuration, especially if subscriber-level access or higher is present. The Contact Email custom field must be in use and rendered on the public single-listing output page for exploitation to be possible. There is no evidence of public exploitation or specific attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.