CVE-2026-111069 paoltaia CVE debrief

Who should care

Defenders responsible for WordPress installations with the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin should assess exposure of subscriber-level access and above.

Why it matters

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping.

• Defenders should verify the presence of this vulnerability in their WordPress installations
• Assess exposure of subscriber-level access and above
• Restrict access to the twitterusername field
• Implement additional input sanitization and output escaping measures

Technical summary

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. The vulnerability allows authenticated attackers with subscriber-level access and above to inject malicious scripts, potentially leading to unauthorized actions on behalf of the user. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of subscriber-level access and above.

Recommended defensive actions

• Verify the presence of this vulnerability in your WordPress installations
• Assess exposure of subscriber-level access and above
• Restrict access to the twitterusername field
• Implement additional input sanitization and output escaping measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.