CVE-2024-3732 — Cross-site Scripting in Geodirectory

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

5.4MEDIUMNVD

CNA6.4

EPSS

0.1%

top 70.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ayecode Geodirectory Paoltaia Geodirectory WP Business Directory Plugin AND Classified Listings Directory

Timeline

PublishedApr 23

Description

The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5paoltaia/geodirectory_wp_business_directory_plugin_and_classified_listings_directory2.3.48

▶NVDayecode/geodirectory< 2.3.49

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

GHSA

GHSA-c8v3-wvcw-2g23: The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via↗2024-04-23

▶

CVEList

GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode↗2024-04-23

▶