Business Directory EUVD-2026-53956

Exploitation requires an authenticated WordPress subscriber-level account on the target site - the lowest registered user role. This means open user registration materially increases exposure; sites with registration disabled are only vulnerable if an attacker can obtain credentials through other means. A victim with higher privileges (editor, administrator, or similar) must view the page or admin panel rendering the attacker's injected content (UI:R), which is the second required condition. The Business Directory plugin must be installed and active. No specific non-default configuration is described as required beyond plugin presence. Limiting factors: absence of open user registration eliminates self-service account creation; restricting access to directory submission to trusted roles removes the injection vector; CSP headers can neutralize script execution even after injection.

The CVSS 6.5 score reflects a medium-severity finding with a meaningful but bounded threat profile. The network vector (AV:N) and low complexity (AC:L) indicate no special network position or exploitation skill is required - an attacker with a subscriber account can submit a payload directly over the web. User interaction (UI:R) is the primary limiting factor; an admin or elevated user must view the poisoned content for the payload to execute, which is typical for Stored XSS in backend-visible fields. EPSS data is not present in the provided intelligence, so probability-of-exploitation in the next 30 days cannot be quantified. KEV status is negative and no POC has been reported - exploitation is plausible but not confirmed active. The realistic priority is elevated on sites with open user registration, since acquiring a subscriber account costs nothing. Sites without public registration have a meaningfully reduced attack surface. The A:L metric in the provided CVSS vector appears slightly overstated for typical XSS; availability impact is not independently supported by the description.

An attacker registers a free subscriber account on a WordPress site running Business Directory. The attacker submits a directory listing or business profile containing a crafted JavaScript payload in an insufficiently sanitized input field. When an administrator reviews or moderates the submission through the WordPress backend, the script executes in the administrator's browser, potentially exfiltrating the session cookie or triggering an unauthorized admin action such as creating a new administrator account. No public exploit code is known at this time.