WordPress plugins that provide business directory functionality often allow administrators and editors to customize categories, icons, images, and other visual elements. While these features improve usability, they also increase the attack surface if user-controlled input is not properly validated before being stored and rendered.
During security testing of the GeoDirectory plugin, a Stored Cross-Site Scripting (Stored XSS) vulnerability was discovered affecting versions prior to 2.8.110. The vulnerability allows an authenticated Editor (or higher) to inject malicious JavaScript into the Map Icon parameter of a Place Category. The payload is permanently stored and later executed whenever the vulnerable page is viewed by another privileged user.
Because the malicious payload is stored inside the WordPress database, every administrator who accesses the affected interface can unknowingly execute attacker-controlled JavaScript, potentially resulting in complete administrative account compromise.
| CVE | CVE-2025-15677 |
| Plugin Version | GeoDirectory < 2.8.110 |
| All Time | 1 164 573 |
| Active installations | 10 000+ |
| Publicly Published | July 24, 2026 |
| Last Updated | July 24, 2026 |
| Researcher | Artyom Krugov |
| PoC | Yes |
| Exploit | No |
| Reference | https://wpscan.com/vulnerability/bb6daced-3ee3-4ec7-a221-9981cd85285a/ https://www.cve.org/CVERecord?id=CVE-2025-15677 |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 16, 2025 | Plugin testing and vulnerability detection in GeoDirector were completed. |
| April 16, 2025 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| July 24, 2026 | CVE-2025-15677 was publicly published by WPSCAN. |
Discovery of the Vulnerability
The vulnerability was discovered during a security assessment of the GeoDirectory plugin while reviewing administrative functionality responsible for managing business directory categories.
The vulnerable functionality is located in:
Places → Place Categories
Each category allows administrators to define a custom Map Icon.
Although the interface normally expects an image URL, the value supplied through the HTTP request is insufficiently validated before being saved.
Understanding of Stored XSS attacks
Stored Cross-Site Scripting occurs when malicious JavaScript is permanently stored by the application and later delivered to other users.
Unlike Reflected XSS, Stored XSS does not require victims to click a specially crafted URL.
The attack flow is simple:
- The attacker submits malicious input.
- The application stores the payload.
- Another user opens the vulnerable page.
- The browser executes the injected JavaScript automatically.
In WordPress environments this vulnerability is particularly dangerous because many administrative interfaces display user-controlled content without sufficient output encoding.
Exploiting the Stored XSS Vulnerability
The vulnerability can be reproduced using the following steps.
POC:
PoC Payload: 123123"onmouseover='alert(999)'____
When the affected image is rendered and interacted with, the injected JavaScript executes.
Recommendations for Improved Security
To mitigate the risks associated with CVE-2025-15677, administrators should immediately update GeoDirectory to version 2.8.110 or later.
Developers should ensure that all values submitted through administrative interfaces—including the Map Icon field and related parameters such as ct_cat_icon[src]—are properly validated, sanitized, and securely encoded before being stored or rendered. User-controlled data should never be inserted directly into HTML attributes without appropriate escaping.
WordPress escaping functions such as esc_attr(), esc_url(), esc_html(), and sanitization functions like sanitize_text_field() or esc_url_raw() should be consistently applied based on the expected data type. If only image URLs are intended, strict allowlisting and URL validation should be enforced instead of accepting arbitrary input.
By addressing Stored XSS like CVE-2025-15677, WordPress site owners can reduce the risk from unsafe media metadata and protect visitors from browser-side compromise. Stay vigilant, stay secure.
#WPSCANSecurity #StoredXSS #WebsiteSafety #StayProtected #Vulnerability
Use CleanTalk solutions to improve the security of your website
