🔐 CVE Alert

CVE-2026-118635

MEDIUM 6.5

GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CWE CWE-94
Vendor paoltaia
Product geodirectory – wp business directory plugin and classified listings directory
Published Oct 30, 2026
Last Updated Oct 30, 2026
Stay Ahead of the Next One

Get instant alerts for paoltaia geodirectory – wp business directory plugin and classified listings directory

Be the first to know when new medium vulnerabilities affecting paoltaia geodirectory – wp business directory plugin and classified listings directory are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

paoltaia / GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
0 ≤ 2.8.198

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/613531ba-0dbb-4c2d-9c40-e11f31cf4575?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L2044 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L2005 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/widgets/class-geodir-widget-listings.php#L1171 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.198/includes/class-geodir-ajax.php#L1482 github.com: https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3773265/geodirectory/trunk/includes/widgets/class-geodir-widget-listings.php

Credits

Wordfence PRISM