CVE-2025-10178

MediumCVSS 6.4

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The CM Business Directory plugin for WordPress in versions up to and including 1.5.2 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'cmbd_featured_image' shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes.

Risk Assessment

An authenticated attacker with contributor-level access or above can inject arbitrary scripts into pages that execute whenever a user visits the injected page, potentially leading to session theft or account takeover.

Recommendation

Update the CM Business Directory plugin to the latest version and consider restricting contributor-level permissions to a minimum.

Other vulnerabilities in CM Business Directory

CVE-2026-8892Medium
The CM Business Directory plugin for WordPress up to version 1.5.7 is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when users visit affected pages.

Original NVD description (English source)

The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS