Geodirectory
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:geodirectory:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Geodirectory (ceeca8a1-a43f-5512-bb02-2a84a159cd25) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-113490 |
vulnerable | 2026-11-03 10:16:27.787526 |
GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
Published: 2026-10-24T06:00:19.138Z
Updated: 2026-10-24T14:36:54.215Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113488 |
vulnerable | 2026-11-03 10:16:27.730234 |
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
Published: 2026-10-28T06:00:26.104Z
Updated: 2026-10-28T17:58:04.973Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113494 |
vulnerable | 2026-11-03 10:16:27.695813 |
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
Published: 2026-10-28T06:00:26.281Z
Updated: 2026-10-28T17:58:04.748Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113491 |
vulnerable | 2026-11-03 10:16:27.615045 |
GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
Published: 2026-10-24T06:00:19.319Z
Updated: 2026-10-24T14:36:54.057Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113489 |
vulnerable | 2026-11-03 10:16:27.572459 |
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
Published: 2026-10-24T06:00:18.964Z
Updated: 2026-10-24T14:36:54.372Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113674 |
vulnerable | 2026-11-03 10:16:27.525124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113493 |
vulnerable | 2026-11-03 10:16:27.424588 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113487 |
vulnerable | 2026-11-03 10:16:27.279451 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113492 |
vulnerable | 2026-11-03 10:16:27.072935 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113673 |
vulnerable | 2026-11-03 10:16:27.057656 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114270 |
vulnerable | 2026-11-03 10:15:52.880682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16988 |
vulnerable | 2026-09-16 04:32:57.053304 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16968 |
vulnerable | 2026-09-16 04:32:56.828811 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15677 |
vulnerable | 2026-09-16 04:27:17.832149 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6200 |
vulnerable | 2026-06-08 07:43:14.526276 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0278 |
vulnerable | 2026-06-08 05:52:04.664679 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4775 |
vulnerable | 2026-06-08 05:52:00.351455 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.