Skip to content
PluginCanary

GeoDirectory - WP Business Directory Plugin and Classified Listings Directory

by Paolo · 10,000+ active installs · Checked 3 Nov 2026
Healthy28 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 2.8.198.

86/ 100 Canary Score
Sub-scores for GeoDirectory - WP Business Directory Plugin and Classified Listings Directory
Ownership100
Maintenance100
Security60
Support91
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.8.198. Update to version 2.8.198 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.8.200. Update to version 2.8.200 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 2.8.199. Update to version 2.8.199 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.8.196. Update to version 2.8.196 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.8.196. Update to version 2.8.196 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.8.195. Update to version 2.8.195 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 27 Oct 2026, fixed in 2.8.197. Update to version 2.8.197 or later.27 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 2.8.194. Update to version 2.8.194 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 2.8.192. Update to version 2.8.192 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 2.8.193. Update to version 2.8.193 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 2.8.191. Update to version 2.8.191 or later.13 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 2.8.191. Update to version 2.8.191 or later.13 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 2.8.188. Update to version 2.8.188 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 2.8.189. Update to version 2.8.189 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 2.8.187. Update to version 2.8.187 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 2.8.184. Update to version 2.8.184 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 2.8.182. Update to version 2.8.182 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 2 Sep 2026, fixed in 2.8.175. Update to version 2.8.175 or later.2 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 26 Aug 2026, fixed in 2.8.177. Update to version 2.8.177 or later.26 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 19 Aug 2026, fixed in 2.8.174. Update to version 2.8.174 or later.19 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 18 Aug 2026, fixed in 2.8.178. Update to version 2.8.178 or later.18 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 11 Aug 2026, fixed in 2.8.170. Update to version 2.8.170 or later.11 Aug 2026Evidence
  • InfoSEC-341 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
paoltaia21 Apr 2014 to 19 Aug 2019, 147 commits
stiofansisland13 May 2016 to 2 Nov 2026, 340 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
121
Tested up to
7.1 current
Requires PHP
5.6 supported 8.2+
Releases per quarter for GeoDirectory - WP Business Directory Plugin and Classified Listings Directory
Q1 202411
Q2 202413
Q3 202422
Q4 202415
Q1 202514
Q2 202515
Q3 202513
Q4 202514
Q1 20266
Q2 202610
Q3 202621
Q4 202616

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

91% of 11 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection6.4<= 2.8.1972.8.1980
30 Oct 2026GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter6.4<= 2.8.1992.8.2000
30 Oct 2026GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter6.5<= 2.8.1982.8.1990
28 Oct 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4< 2.8.1962.8.1960
28 Oct 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4< 2.8.1962.8.1960
28 Oct 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference4.3< 2.8.1952.8.1950
27 Oct 2026GeoDirectory <= 2.8.196 - Unauthenticated Information Exposure5.3<= 2.8.1962.8.1970
22 Oct 2026GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Missing Authorization5.3<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Arbitrary Media File Read6.5<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure5.3<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure5.3<= 2.8.1932.8.1940
22 Oct 2026GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution7.2<= 2.8.1932.8.1940
15 Oct 2026GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute6.4<= 2.8.1912.8.1920
15 Oct 2026GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field6.4<= 2.8.1922.8.1930
13 Oct 2026GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title6.4<= 2.8.1902.8.1910
13 Oct 2026GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title6.4<= 2.8.1902.8.1910
9 Oct 2026GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter8.1<= 2.8.1872.8.1880
9 Oct 2026GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field6.4<= 2.8.1882.8.1890
2 Oct 2026GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing7.5<= 2.8.1862.8.1870
24 Sep 2026GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter6.4<= 2.8.1832.8.1840
24 Sep 2026GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')6.4<= 2.8.1812.8.1820
2 Sep 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection7.5<= 2.8.1742.8.1750
26 Aug 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery4.3<= 2.8.1762.8.1770

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for GeoDirectory - WP Business Directory Plugin and Classified Listings Directory
Q2 20253.5
Q3 20255.0
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0

Average rating rose from 3.5 to 5.0 between Q2 2025 and Q3 2026.

Rating distribution
5 star651
4 star19
3 star9
2 star8
1 star29
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for GeoDirectory - WP Business Directory Plugin and Classified Listings Directory
4 May 20261,024
11 May 20268,931
18 May 20263,541
25 May 20261,611
1 Jun 20268,443
8 Jun 202615,631
15 Jun 20263,240
22 Jun 20268,905
29 Jun 20269,119
6 Jul 20263,505
13 Jul 20269,788
20 Jul 20269,091
27 Jul 20269,254
3 Aug 20269,647
10 Aug 202618,106
17 Aug 202624,085
24 Aug 202610,900
31 Aug 20269,406
7 Sep 20268,999
14 Sep 202610,199
21 Sep 202622,048
28 Sep 202621,685
5 Oct 202624,671
12 Oct 202615,988
19 Oct 202625,335
26 Oct 202619,703
2 Nov 20262,618

Weekly downloads over the last 4 weeks are 36% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Simple Job BoardScore 92 · 10,000+HivePress MessagesScore 91 · 7,000+HivePress ReviewsScore 91 · 7,000+HivePress FavoritesScore 91 · 7,000+HivePress GeolocationScore 91 · 6,000+

Facts

Version2.8.201
AuthorPaolo
Added21 Apr 2014
Last updated2 Nov 2026
Active installs10,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP5.6
CategoryE-commerce & Shopping
Tagslistings, directory, classifieds, directory plugin, business directory

Questions

Is GeoDirectory - WP Business Directory Plugin and Classified Listings Directory still maintained?

GeoDirectory - WP Business Directory Plugin and Classified Listings Directory was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is GeoDirectory - WP Business Directory Plugin and Classified Listings Directory safe?

GeoDirectory - WP Business Directory Plugin and Classified Listings Directory has no open unpatched vulnerabilities on record. 41 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns GeoDirectory - WP Business Directory Plugin and Classified Listings Directory?

The wordpress.org author is Paolo. Recent committers: stiofansisland, paoltaia, plugin-master. We have recorded no ownership change.

What can I use instead of GeoDirectory - WP Business Directory Plugin and Classified Listings Directory?

Plugins in the same category with a higher Canary Score: Simple Job Board, HivePress Messages, HivePress Reviews, HivePress Favorites, HivePress Geolocation.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue