CVE-2026-57326

The Business Directory plugin version 6.4.22 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

The risk includes user session theft, redirects to malicious sites, and theft of sensitive data, potentially leading to security breaches and reputational damage for the organization.

It is recommended to immediately update the Business Directory plugin to the latest available version that fixes this vulnerability. A security audit of the website should also be performed.