Description

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-26T07:17:01.847Z",
  "pubdate": "2026-09-26T07:17:01.847Z",
  "executiveSummary": "The WP Directory Kit WordPress plugin, in versions prior to 1.5.8, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw originates from the improper handling of user-supplied data within category and location fields, which fail to undergo necessary sanitization or output escaping processes.\nThe vulnerability allows an authenticated user, specifically one assigned a listing-management role within the plugin, to inject malicious JavaScript payloads into the system. Despite these users lacking the 'unfiltered_html' capability, the application fails to validate the input, allowing scripts to be persisted in the database.\nWhen a visitor—including administrative users—loads a page containing these affected attributes, the injected script executes within the context of the victim's browser session. This enables attackers to perform unauthorized actions on behalf of the victim, potentially leading to session hijacking, credential theft, or further malicious site manipulation. Given the nature of Stored XSS, the impact is significant, as the payload remains active until manually removed by an administrator or through a database-level remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and output encoding mechanisms applied to specific directory-related fields within the WP Directory Kit plugin. Specifically, the fields corresponding to 'category' and 'location' data are processed by the application without adhering to secure coding standards such as WP_kses or esc_html/esc_attr functions prior to rendering them in page attributes.\nThe attack flow begins when an authenticated user, possessing the plugin-specific listing-management role, updates or creates a directory entry. Because the plugin does not enforce strict sanitization on the input fields, an attacker can supply crafted JavaScript payloads—such as <script>alert(document.cookie)</script>—directly into the category or location metadata inputs. The application accepts this input and stores it persistently in the WordPress database.\nOnce the data is saved, the vulnerability is triggered whenever a public-facing or administrative page retrieves and outputs these attributes. The absence of output escaping results in the browser interpreting the injected script as valid executable code rather than plain text. Consequently, the payload executes automatically in the browser of any user who views the page, regardless of their own privilege level. This mechanism enables the execution of arbitrary scripts, potentially allowing attackers to scrape sensitive data, redirect users to malicious domains, or perform administrative tasks via CSRF, provided the victim is an authenticated administrator.\nThe scope of this vulnerability is limited to WP Directory Kit versions prior to 1.5.8. The exploitation requirements include an account with the listing-management role; however, this is a significant risk in multi-user environments where directory management permissions are granted to untrusted or compromised accounts. The exposure is persistent and global, as the XSS payload propagates to every instance where the compromised category or location field is rendered within the frontend or backend interface."
}