GCVE - cpe:2.3:a:unknown:geodirectory:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:geodirectory:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Geodirectory (`ceeca8a1-a43f-5512-bb02-2a84a159cd25`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-6200`	vulnerable	2026-06-08 07:43:14.526276	GeoDirectory < 2.8.120 - Contributor+ Stored XSS The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Published: 2025-07-11T06:00:11.028Z Updated: 2026-01-09T20:22:59.234Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/27c35255-4963-4d93-85e7-9e7688e5eb2e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0278`	vulnerable	2026-06-08 05:52:04.664679	GeoDirectory < 2.2.24 - Admin+ SQLi The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Published: 2023-02-27T15:24:40.738Z Updated: 2025-03-10T18:14:48.314Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/98deb84e-01ca-4b70-a8f8-0a226daa85a6 https://bulletin.iese.de/post/geodirectory_2-2-21	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4775`	vulnerable	2026-06-08 05:52:00.351455	GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Published: 2023-01-23T14:32:01.696Z Updated: 2025-04-03T19:13:36.433Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5ab3fc58-7d1c-4bcd-8bbd-86c62a3f979c	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.