Business Directory CVE-2026-28004

The attacker requires no account or authentication on the target WordPress installation (PR:N confirmed by CVSS vector). The target site must be running the Business Directory plugin by Strategy11 Team in version 6.4.25 or earlier. Successful exploitation requires a victim - ideally a privileged WordPress user such as an administrator - to be socially engineered into clicking a maliciously crafted URL (UI:R confirmed by CVSS vector). The attack is limited by this required user interaction: passive drive-by exploitation without victim action is not possible under the reflected XSS model. There is no indication that any non-default plugin configuration is required; the vulnerable input appears to be accessible via standard public-facing plugin functionality. The specific parameter or endpoint containing the unsanitized reflection point is not named in the available data.

The CVSS 7.1 High score is driven by network reachability (AV:N), low attack complexity (AC:L), no required attacker privileges (PR:N), and a scope change (S:C) - all of which are genuine risk amplifiers. The single meaningful friction point is user interaction (UI:R): a victim must follow a crafted link, which limits the attack to phishing or social engineering delivery rather than fully passive exploitation. No EPSS data was supplied, and no KEV listing exists, so probability of observed mass exploitation in the wild is unconfirmed. The combination of PR:N and a WordPress plugin surface makes this accessible to unsophisticated attackers who can construct a simple reflected XSS payload, meaning even a mid-sized municipal IT team in zabrze running a public-facing business directory should treat remediation as urgent rather than deferring to a routine patch cycle. The A:L metric in the official CVSS vector is atypical for a reflected XSS and may reflect a specific denial-of-service angle not elaborated in the description; this should be verified against the Patchstack advisory for clarity.

An attacker identifies a WordPress site running Business Directory ≤ 6.25 via passive reconnaissance, crafts a URL embedding a JavaScript payload in a vulnerable query parameter, then delivers the link to a site administrator or logged-in user via email, social media, or a forum post. When the victim clicks the link, their browser renders the plugin's response containing the injected script, which silently exfiltrates the victim's WordPress session cookie to an attacker-controlled server, granting the attacker authenticated access to the WordPress backend. No public proof-of-concept exploit has been identified at time of analysis, but the low complexity rating indicates the attack requires only basic XSS knowledge.