Directorist, a WordPress plugin for business directories, is vulnerable to stored XSS through the ‘phone’ field in listings. The flaw arises because user input is not properly sanitized or escaped before being stored and later rendered. Authenticated users with subscriber‑level access and the grant of edit_at_biz_dirs and publish_at_biz_dirs capabilities can submit malicious scripts that will execute in the browsers of any visitor to the page where the listing is displayed. This can lead to session hijacking, data theft, or defacement, posing a client‑side compromise risk for all users who view the affected listing.

All installations of Directorist: AI‑Powered Business Directory, Listings & Classified Ads with version numbers up to and including 8.10.2.1 are affected. The plugin is developed by wpwax and is widely distributed as a WordPress add‑on. No specific sub‑product or module is exempted within the scope; the issue exists in every version exposed to the phone field handling code, from 8.9.6 through 8.10.2.1.

The exploit requires an authenticated WordPress session with subscriber role privileges that allow editing or publishing listings. The vulnerability has a CVSS score of 6.4, indicating moderate severity, but the EPSS score is less than 1 %, so the likelihood of exploitation is low at present. The issue is not listed in the CISA KEV catalog. Nonetheless, attackers can leverage compromised listings to inject arbitrary client‑side code when visitors view the listings, potentially leading to credential theft or session hijacking.