What is the CVSS score of CVE-2026-57326?

CVE-2026-57326 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Business Directory CVE-2026-57326

EUVD-2026-40097 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-j7vw-hgqm-mjq6

XSS Business Directory WordPress Wordpress Plugin

6.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated injection with scope change into victim browser; UI:R limits exploitation; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 15:22 NVD

6.5 (MEDIUM) 6.1 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 15:16 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Business Directory WordPress plugin (versions <= 6.4.22) allows remote attackers without any authentication to inject and store arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible exploitation requiring no privileges, with a scope change indicating the payload crosses from the plugin's execution context into the victim's browser session. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and low complexity lower the barrier to abuse significantly.

Technical ContextAI

The Business Directory plugin (CPE: cpe:2.3:a:strategy11_team:business_directory:*:*:*:*:*:*:*:*) is a WordPress plugin published by Strategy11 Team that enables site owners to build and manage directory listings. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning one or more user-supplied input fields - likely a directory listing field such as a business name, description, or contact field - are insufficiently sanitized or escaped before being rendered in HTML output. The scope change (S:C in CVSS) indicates the payload escapes the plugin's own trust boundary and executes within the victim browser's session, enabling theft of session cookies, credential harvesting, or forced actions on behalf of the authenticated victim. Reported and disclosed by Patchstack via their WordPress vulnerability database.

RemediationAI

Update the Business Directory plugin to a version beyond 6.4.22 immediately; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-22-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted for the confirmed fixed version, which is not independently specified in the available input data. Until patching is complete, operators can restrict unauthenticated submission to directory listing fields by requiring user login before allowing new entries - this trades off public submission functionality but eliminates the unauthenticated injection vector. Installing a WordPress WAF rule targeting reflected or stored XSS patterns in business directory input fields (e.g., via Patchstack's virtual patching or Wordfence) provides a compensating control with minimal side effects. Review existing directory listings for injected script tags as part of incident assessment.