CVE-2026-96766 Details

A stored cross-site scripting vulnerability has been identified in the GeoDirectory WP Business Directory Plugin and the Classified Listings Directory plugin for WordPress. This issue affects all versions up to and including 2.8.183. The vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. The vulnerability is exploited through the 'business_hours' parameter, as the AJAX save handler only verifies post authorship and a nonce, without additional capability checks. This oversight enables any subscriber-level user who owns a listing to exploit the vulnerability.