CVE-2025-15677: Unknown Geodirectory

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affected products

• Unknown Geodirectory: before 2.8.110 (fixed in 2.8.110)

Published 2026-08-05. Last modified 2026-09-29.