GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

674 searches this plugin appeared in over the last 90 days, 20 listed. 570 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 89% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 10.1 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ Anonymous

   7mo ago

   These people make a powerful directory product and are pretty darned helpful.

   Read on wp.org ↗
2. ★★★★★ kylecoleman

   7mo ago

   Thanks to the Geodirectory team they have helped me fix a issue that took me almost a week to try and fix. Turn around time support is exceptional, thanks again for the great support.

   Read on wp.org ↗
3. ★★★★★ johnhuk55

   7mo ago

   Started to use GeoDirectory for my local town Sandwich, Kent and have been so grateful to the support team for helping me learn how to make best use of the tools. So far, very impressed .. quick answers, friendly and professional. Highly recommend as a Directory and Events plugin solution for WordPress

   Read on wp.org ↗
4. ★★★★★ dpwsl

   9mo ago

   Great plugin and support, would recommend to those needing a flexible directory website.

   Read on wp.org ↗
5. ★★★★★ stephenwp001

   9mo ago

   The GEO Directory plugin is awesome and by far the best WP directory plugin I’ve used. The developers have done an amazing job, I’m so glad I switched plugins. The functionality is brilliant and the option settings are extremely thorough indeed. Basically they’ve covered everything in great detail. The company also provides two additional plugins to make your directory a fully functional website with payment facilities and user profiles. I also have to mention their support staff, WOW, they are so helpful, knowledgeable, and quick to respond. Thank you so much.

   Read on wp.org ↗
6. ★★★★★ redrabbit63

   9mo ago

   We use GeoDirectory for a business directory so its crucial the site is functioning correctly. Support has always been very responsive to any questions we have.

   Read on wp.org ↗
7. ★★★★★ bychancegraphicsllc

   9mo ago

   GUUST is AMAZING! Patient, extremely knowledgeable, and supportive. Guust deserves a raise! This plug-in does exactly what I wanted it to do. The support I received was very helpful, and very fast. I’m so glad I chose GeoDirectory! Thanks Guust!

   Read on wp.org ↗
8. ★★★★★ fcitdavid

   9mo ago

   In styling this plugin for my use case I have had a couple of questions that have stumped me. When I’ve reached out for support the response has been quick, accurate and helpful. I’m very happy with the results.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-29 Version 8.200 Sanitize popover-html attributes in listing description to prevent XSS – FIXED/SECURITY 8.200
2. 2026-10-29 Version 8.199 Validate listings widget advanced pagination info to prevent shortcode injection – FIXED/SECURITY PHP warnings from is_page() & is_front_page() on search results page – FIXED Listings with equal sort values shown twice o 8.199
3. 2026-10-27 Version 8.198 Auto-drafts deleted by WP cron leave orphaned rows in the CPT detail table – FIXED Stored XSS via image title on the listing edit screen – FIXED/SECURITY 8.198
4. 2026-10-23 Version 8.197 REST API: Restrict address & custom fields for password protected listings – FIXED/SECURITY 8.197
5. 2026-10-22 Version 8.196 Post badge link and cta XSS escaping against deeply nested HTML entities – FIXED/SECURITY 8.196
6. 2026-10-21 Version 8.195 Enforced listing visibility and password protection across content output paths – FIXED/SECURITY 8.195

All 50 disclosed vulnerabilities are patched in the current version (2.8.200). Sites still on an older version should update.

1. Patched Medium · 6.4 GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection ↗
   2026-10-30 CVE-2026-116752 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.197 Patched in 2.8.198
2. Patched Medium · 6.4 GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter ↗
   2026-10-30 CVE-2026-119113 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.199 Patched in 2.8.200
3. Patched Medium · 6.5 GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter ↗
   2026-10-30 CVE-2026-118635 Improper Control of Generation of Code Affects <= 2.8.198 Patched in 2.8.199
4. Patched Medium · 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-28 CVE-2026-113488 Improper Neutralization of Input During Web Page Generation Affects < 2.8.196 Patched in 2.8.196
5. Patched Medium · 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-28 CVE-2026-113487 Improper Neutralization of Input During Web Page Generation Affects < 2.8.196 Patched in 2.8.196
6. Patched Medium · 4.3 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference ↗
   2026-10-28 CVE-2026-113494 Authorization Bypass Through User-Controlled Key Affects < 2.8.195 Patched in 2.8.195
7. Patched Medium · 6.4 GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-22 CVE-2026-113493 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.193 Patched in 2.8.194
8. Patched Medium · 6.5 GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Arbitrary Media File Read ↗
   2026-10-22 CVE-2026-113491 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.8.193 Patched in 2.8.194
9. Patched Medium · 5.3 GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure ↗
   2026-10-22 CVE-2026-113492 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.193 Patched in 2.8.194
10. Patched Medium · 5.3 GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure ↗
    2026-10-22 CVE-2026-113490 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.193 Patched in 2.8.194
11. Patched Medium · 4.3 GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-10-22 CVE-2026-113489 Authorization Bypass Through User-Controlled Key Affects <= 2.8.193 Patched in 2.8.194
12. Patched High · 7.2 GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution ↗
    2026-10-22 CVE-2026-113673 Improper Control of Generation of Code Affects <= 2.8.193 Patched in 2.8.194
13. Patched Medium · 5.3 GeoDirectory <= 2.8.193 - Missing Authorization ↗
    2026-10-22 CVE-2026-113674 Missing Authorization Affects <= 2.8.193 Patched in 2.8.194
14. Patched Medium · 6.4 GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute ↗
    2026-10-15 CVE-2026-110703 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.191 Patched in 2.8.192
15. Patched Medium · 6.4 GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field ↗
    2026-10-15 CVE-2026-111069 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.192 Patched in 2.8.193
16. Patched Medium · 6.4 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title ↗
    2026-10-13 CVE-2026-107650 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.190 Patched in 2.8.191
17. Patched Medium · 6.4 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title ↗
    2026-10-13 CVE-2026-107754 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.190 Patched in 2.8.191
18. Patched High · 8.1 GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter ↗
    2026-10-09 CVE-2026-104899 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.8.187 Patched in 2.8.188
19. Patched Medium · 6.4 GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field ↗
    2026-10-09 CVE-2026-104993 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.188 Patched in 2.8.189
20. Patched High · 7.5 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing ↗
    2026-10-02 CVE-2026-103913 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.186 Patched in 2.8.187
21. Patched Medium · 6.4 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter ↗
    2026-09-24 CVE-2026-96766 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.183 Patched in 2.8.184
22. Patched Medium · 6.4 GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') ↗
    2026-09-24 CVE-2026-93897 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.181 Patched in 2.8.182
23. Patched High · 7.5 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection ↗
    2026-09-02 CVE-2026-84813 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.174 Patched in 2.8.175
24. Patched Medium · 4.3 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery ↗
    2026-08-26 CVE-2026-81271 Cross-Site Request Forgery Affects <= 2.8.176 Patched in 2.8.177
25. Patched High · 7.2 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-08-19 CVE-2026-66604 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.173 Patched in 2.8.174
26. Patched Medium · 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2026-08-18 CVE-2026-68565 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.177 Patched in 2.8.178
27. Patched High · 8.1 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision ↗
    2026-08-11 CVE-2026-19091 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.8.169 Patched in 2.8.170
28. Patched Medium · 5.3 GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure ↗
    2026-08-03 CVE-2026-16988 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.168 Patched in 2.8.169
29. Patched Medium · 4.4 GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2026-07-28 CVE-2025-15677 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.109 Patched in 2.8.110
30. Patched Medium · 4.3 GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure ↗
    2026-07-27 CVE-2026-16968 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.8.167 Patched in 2.8.168
31. Patched Medium · 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery ↗
    2026-06-30 CVE-2026-57681 Server-Side Request Forgery Affects <= 2.8.161 Patched in 2.8.162
32. Patched High · 7.5 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 - Unauthenticated SQL Injection ↗
    2026-06-17 CVE-2026-54831 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.162 Patched in 2.8.163
33. Patched Medium · 5.3 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization ↗
    2026-05-13 CVE-2026-42671 Missing Authorization Affects <= 2.8.157 Patched in 2.8.158
34. Patched High · 7.5 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection ↗
    2026-04-13 CVE-2026-39512 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.152 Patched in 2.8.154
35. Patched Medium · 4.3 GeoDirectory <= 2.8.149 - Cross-Site Request Forgery ↗
    2026-01-23 CVE-2026-24549 Cross-Site Request Forgery Affects <= 2.8.149 Patched in 2.8.150
36. Patched Medium · 4.3 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment ↗
    2025-11-11 CVE-2025-12833 Authorization Bypass Through User-Controlled Key Affects <= 2.8.139 Patched in 2.8.140
37. Patched Medium · 6.4 GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-06-20 CVE-2025-6200 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.119 Patched in 2.8.120
38. Patched Medium · 6.4 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter ↗
    2025-02-10 CVE-2024-13506 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.97 Patched in 2.8.98
39. Patched High · 7.5 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection ↗
    2025-01-29 CVE-2024-13507 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.97 Patched in 2.8.98
40. Patched Medium · 6.4 GeoDirectory <= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-12-30 CVE-2024-56259 Improper Neutralization of Input During Web Page Generation Affects <= 2.3.84 Patched in 2.3.85
41. Patched Medium · 6.4 GeoDirectory <= 2.3.80 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-10-24 CVE-2024-50437 Improper Neutralization of Input During Web Page Generation Affects <= 2.3.80 Patched in 2.3.81
42. Patched Medium · 4.3 GeoDirectory <= 2.3.70 - Missing Authorization via geodirectory_rated() ↗
    2024-08-28 CVE-2024-43981 Missing Authorization Affects <= 2.3.70 Patched in 2.3.71
43. Patched Critical · 9.9 GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection ↗
    2024-08-07 CVE-2024-43145 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.3.61 Patched in 2.3.62
44. Patched Medium · 6.4 GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode ↗
    2024-04-22 CVE-2024-3732 Improper Neutralization of Input During Web Page Generation Affects <= 2.3.48 Patched in 2.3.49
45. Patched Medium · 6.6 GeoDirectory <= 2.3.28 - Authenticated(Administrator+) SQL Injection ↗
    2023-12-21 CVE-2023-50845 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.3.29 Patched in 2.3.29
46. Patched High · 7.2 GeoDirectory <= 2.3.28 - Authenticated (Administrator+) SQL Injection via orderby ↗
    2023-10-18 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.3.28 Patched in 2.3.29
47. Patched High · 7.2 GeoDirectory <= 2.2.23 - Authenticated (Admin+) SQL Injection ↗
    2023-01-31 CVE-2023-0278 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.2.23 Patched in 2.2.24
48. Patched Medium · 6.4 GeoDirectory <= 2.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2022-12-29 CVE-2022-4775 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.21 Patched in 2.2.22
49. Patched Medium · 4.1 GeoDirectory <= 2.2.19 - CSV Injection ↗
    2022-12-20 Improper Neutralization of Formula Elements in a CSV File Affects <= 2.2.19 Patched in 2.2.20
50. Patched Medium · 6.4 GeoDirectory <= 2.1.1.2 - Authenticated (admin+) Stored Cross-Site Scripting ↗
    2021-09-02 CVE-2021-24720 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.1.2 Patched in 2.1.1.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 131 languages, 4 at 90% or more

Plus 107 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2016-10-08 7K+ → 10K+ up after 204 days in tier
2. 2016-03-18 6K+ → 7K+ up after 77 days in tier
3. 2016-01-01 5K+ → 6K+ up after 115 days in tier
4. 2015-09-08 4K+ → 5K+ up after 99 days in tier
5. 2015-06-01 3K+ → 4K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for GeoDirectory – WP Business Directory Plugin and Classified Listings Directory into a readme, a review or a deck. It updates itself.

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: 10K+ active installs, 4.8★ (716 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/geodirectory