GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• wordfence.com/…lities/id/613531ba-0dbb-4c2d-9c40-e11f31cf4575 Diğer
• plugins.trac.wordpress.org/…ludes/widgets/class-geodir-widget-listings.php Diğer
• plugins.trac.wordpress.org/…ludes/widgets/class-geodir-widget-listings.php Diğer
• plugins.trac.wordpress.org/…ludes/widgets/class-geodir-widget-listings.php Diğer
• plugins.trac.wordpress.org/…ry/tags/2.8.198/includes/class-geodir-ajax.php Diğer
• github.com/…ode/geodirectory/archive/refs/heads/master.zip Diğer
• plugins.trac.wordpress.org/…ludes/widgets/class-geodir-widget-listings.php Diğer

Kayıt geçmişi

1. 30 Eki 2026 20:15Yayımlandı

İlgili açıklar

• 6,4 CVE-2026-119113GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
• 8,8 CVE-2026-63378TAKO AI Agent for Okta: Authenticated Python execution through validator bypass
• 8,6 CVE-2026-63346Refitter: C# source injection through OpenAPI header parameter names
• 8,6 CVE-2026-63344Refitter: C# source injection through OpenAPI content-type map keys
• 8,6 CVE-2026-63345Refitter: C# source injection through OpenAPI path keys
• 9,9 CVE-2026-62853ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks