Business Directory CVE-2026-57328

Exploitation requires a valid subscriber-level WordPress account on the target site - subscriber registration must be enabled (WordPress Setting: Membership > Anyone can register). The attacker must be able to submit content through the Business Directory Plugin's submission interface that is displayed to other users without proper encoding. Exploitation is limited by the UI:R requirement: a victim user (such as an administrator) must navigate to and render the page containing the injected payload. Sites with subscriber registration disabled entirely are not exploitable remotely. Sites where all directory submissions are made only by trusted roles above subscriber are not exploitable via this path.

The NVD-assigned CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L places this in the medium-high tier. The most operationally significant risk signal is the S:C scope change combined with PR:L: a subscriber - the lowest authenticated role in WordPress - can plant a payload that fires in an administrator's session, potentially enabling administrative account takeover or malicious plugin installation without the administrator's knowledge. The UI:R requirement (victim must view the injected content) is a meaningful but manageable barrier; in a live WordPress site with active admin activity, an admin reviewing business directory submissions is a realistic and frequent event. EPSS data was not provided; no KEV listing or public POC was identified in the input data, which moderates urgency somewhat. The A:L (availability) metric in the provided vector is atypical for a pure XSS finding and may reflect the possibility of redirect loops or forced logouts - this should be verified against vendor details.

An attacker registers a free subscriber account on the target WordPress site, then submits a business directory listing containing a crafted JavaScript payload in a field that lacks proper output encoding. When a site administrator reviews or approves pending submissions - a routine administrative task - the stored script executes in the administrator's browser session, potentially exfiltrating the admin's authentication cookies or silently triggering privileged actions such as creating a new admin account. No public proof-of-concept code was identified at time of analysis, though the low attack complexity (AC:L) indicates the technique requires no specialized knowledge beyond basic XSS crafting.