Business Directory EUVD-2026-40097

No authentication is required to inject the malicious payload - the vulnerability is exploitable by any remote unauthenticated party, as confirmed by PR:N in the CVSS vector. The limiting factor is user interaction (UI:R): a victim, typically an authenticated WordPress user or administrator, must navigate to or load the page containing the injected content for the XSS payload to execute. Exploitation is further constrained to WordPress sites with the Business Directory plugin installed and active at version 6.4.22 or earlier. There is no indication the vulnerable input requires any special site configuration or non-default feature flag beyond the plugin being present and accepting public input submissions.

The CVSS 6.5 Medium score reflects the primary limiting factor: user interaction (UI:R) is required, meaning a victim must load the page containing the injected payload. Without that interaction, the attack cannot land. However, the remaining metrics are unfavorable - no authentication required (PR:N), low complexity (AC:L), and network-accessible (AV:N) - meaning the attacker's initial effort to plant the payload is trivial. The scope change (S:C) elevates the realistic impact, as a successful trigger could allow session hijacking or admin account compromise on the WordPress site. No EPSS data was provided in the intelligence, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public exploit code, suggesting this is not currently under active exploitation. Despite the medium CVSS score, WordPress plugin XSS vulnerabilities of this class are historically weaponized in bulk scanning campaigns against WordPress installations, making this a genuine priority for sites running the affected versions.

An unauthenticated attacker submits a directory listing or entry containing a crafted JavaScript payload (e.g., in a business name or description field) to a WordPress site running Business Directory <= 6.4.22. The payload persists in or is reflected from the plugin's output. When a logged-in administrator or site visitor views the affected directory page, the script executes in their browser, potentially stealing session cookies or performing actions under their identity. No public exploit code is confirmed, but the low attack complexity makes manual exploitation straightforward for any attacker familiar with WordPress XSS techniques.