CVE-2026-28004

The Business Directory plugin (business-directory-plugin) in WPTasty contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. The issue affects versions from n/a through 6.4.27.

Business Directory plugin version 6.4.27 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

The Business Directory plugin version 6.4.23 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to administrative functions without requiring authentication.

The Business Directory plugin version 6.4.22 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. An authenticated subscriber can inject malicious JavaScript code.

The Business Directory plugin version 6.4.22 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

The Business Directory plugin version 6.4.26 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability.

The Business Directory plugin versions up to 6.4.26 contain an unauthenticated broken access control vulnerability. An attacker can exploit this flaw to gain unauthorized access to protected features.

Cross Site Scripting (XSS) vulnerability in Business Directory versions up to 6.4.24 allows a Subscriber user to inject malicious script.

The Business Directory plugin for WordPress (versions up to and including 6.4.19) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.