CyberRota Analysis
AI-GeneratedThe GeoDirectory WordPress plugin versions prior to 2.8.110 are vulnerable due to inadequate sanitization and escaping of the place-category setting on an admin page. This flaw allows high-privilege users, such as editors, to execute Stored Cross-Site Scripting (XSS) attacks, potentially compromising the security of the site even in configurations where unfiltered HTML is restricted. WordPress site administrators and security teams should prioritize updating this plugin to mitigate the risk of exploitation.
Original NVD Description
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).