Directorist CVE-2026-100185

Requires a valid subscriber-level (or higher) account on the target site; the realistic prerequisite is that the site permits public/self-service user registration, since the plugin's default grant of the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role lets any such user submit AND publish listings with no admin moderation. The payload is injected via the 'phone' Listing Field, which lacks input sanitization and output escaping. Exploitation is limited by: the need for an authenticated account (PR:L), the requirement that a victim subsequently load the injected listing page for the stored script to fire, and sites that disable open registration or restrict listing publication to moderated/trusted roles materially reduce exposure.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that sits well below top-priority status but is more exploitable than its low privilege/impact metrics suggest in isolation. The network vector and low attack complexity mean exploitation is technically easy, and although PR:L requires authentication, the description confirms the plugin grants subscriber-role users the edit_at_biz_dirs and publish_at_biz_dirs capabilities, so any self-registered subscriber can submit and PUBLISH a malicious listing WITHOUT moderation - effectively lowering the practical bar to near-trivial on sites that allow open registration. The scope-change (S:C) and UI:N reflect that the injected script fires in other users' browser sessions when they view the listing, enabling session/cookie theft or admin-targeted actions. No EPSS score, SSVC decision, KEV listing, or public POC was supplied, so there is no evidence of active or automated exploitation; the C:L/I:L/A:N impact caps the direct damage. Net: a real but second-tier hygiene priority - patch in routine cycles, prioritizing higher if the site permits public subscriber registration. No signals conflict; the main gap is the absence of EPSS/exploit telemetry to gauge real-world targeting.

An attacker self-registers a free subscriber account on a Directorist-powered site and creates a business listing, inserting a malicious script payload into the 'phone' field, which the plugin fails to sanitize or escape on output. Because subscribers can publish listings without moderation, the listing goes live immediately, and the script executes in the browser of any visitor or administrator who views the listing page. No public exploit code was identified at time of analysis, but crafting the payload is straightforward given the detailed source-code references.