What is the CVSS score of CVE-2026-61959?

CVE-2026-61959 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Business Directory CVE-2026-61959

EUVD-2026-53956 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-cv33-h348-47m4

WordPress XSS Business Directory Wordpress Plugin Strategy11 Team

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-exploitable Stored XSS by a subscriber; scope change reflects cross-context execution; availability impact downgraded to None as XSS does not meaningfully disrupt service.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:01 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.

AnalysisAI

Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that subscriber-supplied input - likely a directory listing field, business profile entry, or form submission - is insufficiently sanitized or escaped before being rendered in HTML output. The Business Directory plugin, developed by strategy11_team and identified by CPE cpe:2.3:a:strategy11_team:business_directory:*:*:*:*:*:*:*:*, is a WordPress plugin that allows site owners to publish categorized directory listings. WordPress Subscriber is the lowest registered user role, meaning attackers need only create or obtain a standard account. The Scope change (S:C) in the CVSS vector is consistent with Stored XSS where the payload persists server-side and executes in the victim's browser context, enabling session token theft or UI redressing against admin-level users.

RemediationAI

Update the Business Directory plugin to the version released after 6.4.24; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-24-cross-site-scripting-xss-vulnerability should be consulted for the exact patched version number, which was not independently confirmed in the available intelligence. If an immediate update is not possible, disable open user registration on the WordPress site (Settings → General → Membership) to eliminate the ability of unauthenticated visitors to obtain subscriber accounts - this removes the low-privilege attack path but prevents legitimate self-registration as a side effect. Additionally, review Content Security Policy (CSP) headers to restrict inline script execution, which can reduce the impact of successful XSS even if not preventing injection. WordPress administrators should also audit recently submitted directory listings for suspicious script tags pending patching.