The WP‑BusinessDirectory plugin, distributed by CMSJunkie, contains an improper neutralization of input during web page generation. When the plugin outputs user‑controlled data without adequate escaping, any JavaScript embedded in that data is executed in the victim’s browser. This bug manifests as a reflected cross‑site scripting flaw, allowing an attacker to inject client‑side scripts that run with the privileges of the user viewing the affected page.

All installations of the WordPress Business Directory Plugin released by CMSJunkie that are at or below version 4.0.1. The vulnerable version range is from the earliest release through 4.0.1, and any site using these releases is at risk.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS probability is less than 1 %, suggesting that only a small fraction of potential attacks exploit this flaw, and it is not currently listed in the CISA KEV catalog. The flaw permits arbitrary client‑side script execution when a page reflects unneutralized input. The description does not specify an authentication requirement, implying the vulnerability can be triggered by an unauthenticated attacker who can craft a malicious request or link to a victim.