CVE-2026-100185
MediumCVSS 6.4Summary
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' listing field in all versions up to and including 8.10.2.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages that execute whenever a user visits the injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.
Risk Assessment
An attacker with a subscriber account can persistently inject malicious JavaScript into listings, potentially leading to session theft, redirects, or administrator account takeover. Sites running Directorist version 8.10.2.1 or earlier are at risk.
Recommendation
Update the Directorist plugin to a version newer than 8.10.2.1. Until then, restrict subscriber registration and consider disabling the plugin.
Other vulnerabilities in Directorist
See all- CVE-2026-17092High
The Directorist plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 8.10.2.1. Authenticated attackers with subscriber-level access can delete arbitrary business directory listings, including those owned by other users.
- CVE-2026-59518Critical
The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.
- CVE-2026-84027Medium
The Directorist plugin for WordPress before version 8.9.5 does not check user capabilities when creating orders via REST API, allowing users with subscriber role and above to create paid orders and payment records with arbitrary amounts and attribute them to other users.
- CVE-2026-84026Medium
The Directorist plugin for WordPress before version 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
- CVE-2026-77766Medium
The Directorist plugin for WordPress before version 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected; the endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.
- CVE-2026-84066Low
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
- CVE-2026-77757Medium
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
- CVE-2026-39509Medium
The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS