The GeoDirectory Business Directory WordPress plugin prior to 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).
ayecode geodirectory