Description

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T15:16:57.020Z",
  "pubdate": "2026-08-06T15:16:57.020Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Business Directory plugin for versions up to and including 6.4.24. This security flaw enables authenticated users with Subscriber-level privileges to inject and execute arbitrary client-side scripts, such as JavaScript, within the context of other users' browser sessions when viewing affected administrative or frontend pages.\nThe primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of higher-privileged administrators, and defacement of the affected web application. The risk implications are significant for WordPress deployments utilizing the Business Directory plugin, as attackers possessing low-privilege subscriber accounts can escalate their impact or compromise administrative integrity through social engineering or direct payload execution.\nExploitation requires authenticated access to the target WordPress installation with a minimum role of Subscriber. No complex preconditions are necessary beyond the ability to supply crafted input payloads that fail to undergo proper sanitization and output encoding before being rendered to the browser by the vulnerable component.",
  "technicalDetails": "The vulnerability arises from insufficient input sanitization and improper output encoding of user-supplied data handled by the Business Directory plugin in versions 6.4.24 and prior. Specifically, the vulnerable component fails to adequately strip or neutralize executable HTML and JavaScript constructs supplied by users during profile updates, listing submissions, or form inputs accessible to accounts with low privileges.\nAuthentication and privilege requirements dictate that the threat actor must possess a valid Subscriber-level account on the target WordPress instance. The attack vector is network-based, leveraging HTTP requests submitted via the standard web application interface. Because Subscribers possess restricted capabilities compared to Administrators, this vulnerability represents an authorization-to-privilege boundary violation via indirect client-side code execution.\nThe attack flow proceeds as follows: First, the attacker authenticates as a Subscriber and crafts a malicious payload containing arbitrary JavaScript enclosed within HTML tags, such as script blocks or event handlers (e.g., onload, onerror). Second, the attacker submits this payload into vulnerable input fields within the Business Directory plugin. Third, the application stores or reflects the unsanitized input without applying context-aware output encoding. Finally, when an administrator or higher-privileged user views the rendered data within their browser, the payload executes automatically in the victim's session.\nThe payload behavior includes executing arbitrary scripts within the Document Object Model (DOM) of the victim's browser session. This allows the attacker to interact with the DOM, access session cookies if not protected by strict security flags, issue asynchronous HTTP requests on behalf of the victim, and modify page contents. The post-exploitation impact can range from the creation of unauthorized administrator accounts to the complete compromise of the underlying WordPress environment, depending on the privileges of the interacting victim."
}