CVE-2025-15677 Overview
CVE-2025-15677 is a Stored Cross-Site Scripting (XSS) vulnerability in the GeoDirectory WordPress plugin versions before 2.8.110. The plugin fails to sanitize and escape a place-category setting before rendering it in an admin page. High-privilege users such as editors and administrators can inject persistent JavaScript payloads through this input. The flaw is exploitable even when the unfiltered_html capability is disallowed, which is notable for multisite installations that typically restrict raw HTML. The issue is tracked under CWE-79 and reported through the WPScan Vulnerability Report.
Critical Impact
Authenticated editors can store JavaScript that executes in the browser context of any administrator viewing the affected admin page, enabling session theft or privileged actions.
Affected Products
- GeoDirectory WordPress plugin versions prior to 2.8.110
- WordPress multisite deployments where unfiltered_html is restricted for editors
- WordPress single-site installations running the vulnerable plugin
Discovery Timeline
- 2026-08-05 - CVE-2025-15677 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2025-15677
Vulnerability Analysis
The vulnerability resides in how GeoDirectory processes the place-category setting submitted through its administrative interface. The plugin accepts user-supplied input, stores it, and later renders it back into an admin page without applying WordPress sanitization or output escaping. Attackers with editor privileges or higher can embed arbitrary HTML and JavaScript into the stored value. When another authenticated administrator loads the affected admin page, the browser executes the injected script within the WordPress admin session context. This bypasses the unfiltered_html capability restriction because the plugin performs the storage and rendering itself instead of relying on the WordPress core sanitization pipeline.
Root Cause
The root cause is missing input sanitization on write and missing output escaping on render for the place-category setting. WordPress provides helpers such as sanitize_text_field() and esc_html() or esc_attr() for exactly this purpose. The plugin omitted these calls, treating the field as trusted admin input despite it being reachable by lower-privilege editors in typical role hierarchies.
Attack Vector
Exploitation requires an authenticated account with editor-level or higher privileges and user interaction from a victim administrator who visits the admin page. The attacker submits a malicious place-category value containing an HTML or script payload. The payload is persisted in the database. Any privileged user who subsequently loads the page triggers script execution in their session. See the WPScan Vulnerability Report for further technical details.
Detection Methods for CVE-2025-15677
Indicators of Compromise
- Unexpected <script>, onerror, or onload fragments stored inside GeoDirectory place-category options in the wp_options or plugin-specific tables.
- Admin sessions producing outbound HTTP requests to unfamiliar domains shortly after loading GeoDirectory admin pages.
- Newly created administrator accounts or modified user roles following editor activity on the plugin settings.
Detection Strategies
- Review the plugin database rows for place-category values containing HTML tags or JavaScript event handlers.
- Correlate WordPress audit logs for editor-level edits to GeoDirectory settings with subsequent administrator page views.
- Inspect browser Content Security Policy (CSP) violation reports originating from /wp-admin/ paths tied to GeoDirectory.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record option changes and role modifications.
- Alert on any modification to GeoDirectory settings performed by non-administrator accounts.
- Monitor web server logs for POST requests to GeoDirectory admin endpoints that include encoded script payloads.
How to Mitigate CVE-2025-15677
Immediate Actions Required
- Update the GeoDirectory plugin to version 2.8.110 or later across all sites in a multisite network.
- Audit existing place-category values and remove any entries containing HTML or JavaScript.
- Rotate credentials and session tokens for any administrator that accessed the affected admin page since the vulnerable version was installed.
Patch Information
The vendor addressed the issue in GeoDirectory 2.8.110 by applying sanitization and escaping to the place-category setting. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Restrict editor and contributor accounts from accessing GeoDirectory configuration until the update is applied.
- Enforce a strict Content Security Policy in /wp-admin/ to limit inline script execution.
- Require multi-factor authentication for all accounts with editor privileges or higher to reduce the risk of account takeover leading to exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
