High
CVE-2026-104899
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 35
Reset filters
Medium
CVE-2026-104993
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
High
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
Medium
CVE-2026-96766
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
Medium
CVE-2026-93897
GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
High
CVE-2026-84813
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection
Medium
CVE-2026-81271
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery
High
CVE-2026-66604
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-68565
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19091
GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
Medium
CVE-2026-16988
GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure
Medium
CVE-2025-15677
GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-16968
GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure
Medium
CVE-2026-57681
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-54831
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 - Unauthenticated SQL Injection
High
CVE-2026-11616
Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-42671
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization
High
CVE-2026-39532
Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39512
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection
Medium
CVE-2026-24549
GeoDirectory <= 2.8.149 - Cross-Site Request Forgery
Medium
CVE-2025-12833
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Medium
CVE-2025-6200
GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-26967
Events Calendar for GeoDirectory <= 2.3.14 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2024-13506
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.