What is the CVSS score of EUVD-2026-57943?

EUVD-2026-57943 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Business Directory are affected by EUVD-2026-57943?

The Business Directory WordPress plugin (versions 6.4.25 and earlier) allows attackers to compromise administrator accounts and gain full control of WordPress installations by tricking users into…

How to fix or mitigate EUVD-2026-57943?

Within 24 hours, identify all WordPress installations running Business Directory plugin and confirm affected versions (6.4.25 and below); check the Strategy11 Team plugin repository and security advisories for available patches. Within 7 days, disable the Business Directory plugin on all affected sites immediately as a critical interim control-this is the most effective mitigation available until a patch is released. Implement restrictive Content Security Policy headers to block inline script execution and deploy Web Application Firewall rules to detect and block XSS patterns. Within 30 days, establish monitoring for vendor security updates through official Strategy11 channels; conduct a business impact assessment of functionality dependent on this plugin to identify and plan implementation of alternative solutions; once a patched version is confirmed available, test thoroughly in staging environment and deploy updates across all affected installations in a staged rollout approach.

Business Directory EUVD-2026-57943

| CVE-2026-28004 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-w578-wmpc-67cr

WordPress XSS Business Directory Wordpress Plugin Strategy11 Team

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with no auth required; scope changes to browser session context; availability impact assessed as none, as XSS does not typically disrupt service.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:00 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

AnalysisAI

Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected back into HTML or JavaScript output without adequate encoding or sanitization. The Business Directory plugin (CPE: cpe:2.3:a:strategy11_team:business_directory:*:*:*:*:*:*:*:*) is a WordPress plugin developed by the Strategy11 Team that provides front-end business listing directory functionality. Because unauthenticated users can supply input - likely via search fields, listing submissions, or URL parameters exposed on public-facing directory pages - malicious script content can be embedded in responses served to other users. The S:C designation in the CVSS vector indicates the vulnerability crosses a security boundary: code injected into the plugin's output context can interact with the WordPress session, cookies, and DOM belonging to a different origin or privilege context.

RemediationAI

The primary remediation is to update the Business Directory plugin beyond version 6.4.25 via the WordPress plugin repository; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-25-cross-site-scripting-xss-vulnerability for the confirmed fixed release version, as no specific patched version number is confirmed in the currently available data. As an interim compensating control, site administrators can temporarily disable the Business Directory plugin if the directory functionality is non-essential, which eliminates the attack surface entirely at the cost of losing directory features. Additionally, deploying a web application firewall rule to block requests containing common XSS patterns in parameters served by the plugin's endpoints can reduce exploitation risk, though WAF rules are imperfect and bypass techniques exist. Restricting public access to directory submission or search forms to authenticated users only - if the plugin supports this configuration - would raise the attacker's bar from PR:N to at least PR:L.