CVE-2026-118635mediumCWE-94

CVE-2026-118635: medium-severity vulnerability in paoltaia GeoDirectory – WP Business Directory…

GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

Published

Follow this CVE+ Monitor GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
paoltaia · GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Related CVEs — paoltaia GeoDirectory – WP Business Directory…

In the same product, most dangerous first.

CVE-2026-19091HIGHGeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revisionEPSS 1.1%CVE-2026-104899HIGHGeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' ParameterEPSS 0.6%CVE-2024-13507HIGHGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2024-13506MEDIUMGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name ParameterEPSS 0.4%CVE-2026-103913HIGHGeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending ListingEPSS 0.4%CVE-2026-119113MEDIUMGeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' ParameterEPSS 0.4%