CVE-2026-61959
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in Business Directory versions up to 6.4.24 allows a Subscriber user to inject malicious script.
Risk Assessment
Malicious script can be executed in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update the Business Directory plugin to the latest version that includes the security fix.
Other vulnerabilities in Business Directory
See all- CVE-2026-57339Medium
The Business Directory plugin version 6.4.23 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to administrative functions without requiring authentication.
- CVE-2026-57328Medium
The Business Directory plugin version 6.4.22 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. An authenticated subscriber can inject malicious JavaScript code.
- CVE-2026-57326Medium
The Business Directory plugin version 6.4.22 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-28004High
Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.