CVE-2025-6200

CWE-79 — Cross-site Scripting (XSS)CWE-362 — Race Condition4 documents4 sources

Severity

5.9MEDIUM

EPSS

0.1%

top 81.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Geodirectory Ayecode Geodirectory

Timeline

PublishedJul 11

Description

The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:LExploitability: 1.7 | Impact: 3.7

Affected Packages2 packages

▶CVEListV5unknown/geodirectory< 2.8.120

▶NVDayecode/geodirectory< 2.8.120

🔴Vulnerability Details

CVEList

GeoDirectory < 2.8.120 - Contributor+ Stored XSS↗2025-07-11

▶

GHSA

GHSA-987q-rh8g-5x3f: The GeoDirectory WordPress plugin before 2↗2025-07-11

▶

📋Vendor Advisories

Microsoft

Kernel: icmpv6 router advertisement packets aka linux tcp/ip remote code execution vulnerability↗2024-01-09

▶