What is the CVSS score of CVE-2026-57328?

CVE-2026-57328 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Business Directory CVE-2026-57328

EUVD-2026-40099 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-mfg7-q8ff-25x2

XSS Business Directory WordPress Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber auth required (PR:L), victim must view payload (UI:R), scope changes to other users' browsers (S:C); availability impact not supported by typical stored XSS mechanics.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:21 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

AnalysisAI

Cross-site scripting in the Business Directory WordPress plugin (versions 6.4.22 and earlier) allows authenticated subscriber-level users to inject arbitrary JavaScript that executes in other users' browsers. The scope-change indicator in the CVSS vector (S:C) confirms the payload can cross trust boundaries - most critically, scripts injected by a low-privilege subscriber can execute in the context of a higher-privilege user such as an administrator. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is the Business Directory Plugin for WordPress, identified by CPE cpe:2.3:a:strategy11_team:business_directory:*:*:*:*:*:*:*:* across all versions through 6.4.22. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input accepted at the subscriber privilege tier is insufficiently sanitized or encoded before being rendered back in HTML context. The CVSS vector's S:C (scope change) strongly suggests stored XSS, where the injected payload persists in the database and is later served to other users in a different security context, rather than reflected XSS which would require the attacker to trick a victim into clicking a crafted URL.

RemediationAI

The primary fix is to update the Business Directory Plugin beyond version 6.4.22 via the WordPress dashboard (Plugins > Updates) or by downloading directly from the WordPress plugin repository. The exact patched release version is not independently confirmed in the available input data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-22-cross-site-scripting-xss-vulnerability-2 and the plugin's official changelog for the specific fixed version. If an immediate update is not possible, restrict new business directory submissions to trusted roles above subscriber level - changing the minimum submission role to Editor or higher eliminates the low-privilege injection surface, though this limits plugin functionality. As a secondary control, deploying a web application firewall (WAF) rule targeting XSS payloads in plugin form submissions can reduce risk, though WAF bypass techniques exist and this should not substitute for patching.