CVE-2026-107754
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc
CVSS
6.4
Medium
EPSS
0.3%
p18
KEV
—
Exploit Today
5
0-100
Published: Oct 14, 2026 · Last modified: Oct 14, 2026 · CWE-79
0.3%EPSS · 30 days0.3%
2026-10-142026-10-20
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- github.comhttps://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.188/assets/js/map.js#L1431
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.188/assets/js/map.js#L605
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.188/includes/class-geodir-media.php#L635
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.188/includes/class-geodir-post-data.php#L329
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.188/includes/image-functions.php#L145
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3736457/geodirectory/trunk/assets/js/map.js
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/190d9996-5a3b-477f-9191-d60ce3c33dd9?source=cve
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1108997.1 HIG—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.21hCVE-2026-1074357.1 HIG—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.21hCVE-2026-1140614.7 MED—
——0SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.1dCVE-2026-1137414.3 MED—
——0A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.1dCVE-2026-944026.1 MED—
——0IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.1dCVE-2016-201026.1 MED—
——0JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.1d