GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

Уязвимости

• CVE-2026-84813без авторизации≤ 2.8.174

  WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-54831без авторизации≤ 2.8.162

  WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-39512без авторизации≤ 2.8.152

  WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-81271без авторизации · нужен клик≤ 2.8.176

  WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.8

• CVE-2024-43981нужен вход≤ 2.3.70

  WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2024-43145нужен вход≤ 2.3.61

  WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerability

  Высокий 8.8

• CVE-2026-19091подписчик+≤ 2.8.169

  GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_del

  Высокий 8.1

• CVE-2026-103913без авторизации≤ 2.8.186

  GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

  Высокий 7.5

• CVE-2024-13507без авторизации≤ 2.8.97

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection

  Высокий 7.5

• CVE-2023-50845высокие права≤ 2.3.28

  WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection

  Высокий 7.2

• CVE-2026-66604без авторизации · нужен клик≤ 2.8.173

  WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-42671без авторизации≤ 2.8.157

  WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2026-68565участник+≤ 2.8.172

  WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-96766подписчик+≤ 2.8.183

  GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter

  Средний 6.4

• CVE-2026-93897подписчик+≤ 2.8.181

  GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')

  Средний 6.4

• CVE-2026-57681подписчик+≤ 2.8.161

  WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability

  Средний 6.4

• CVE-2024-13506подписчик+≤ 2.8.97

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_na

  Средний 6.4

• CVE-2024-56259нужен вход≤ 2.3.84

  WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-50437нужен вход≤ 2.3.80

  WordPress GeoDirectory plugin <= 2.3.80 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2021-24720нужен вход→ 2.1.1.3

  GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS)

  Средний 5.4

• CVE-2024-3732участник+≤ 2.3.48

  GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_

  Средний 5.4

• CVE-2026-24549без авторизации · нужен клик≤ 2.8.149

  WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2025-12833автор+≤ 2.8.139

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Atta

  Средний 4.3