The Directorist plugin for WordPress contains a stored cross‑site scripting vulnerability due to improper input neutralization. Attackers can embed malicious JavaScript into fields that are rendered on the site, allowing script execution in the browsers of visitors who view the affected content. This can lead to session hijacking, credential theft, or defacement of the site.

The vulnerable plugin is wpWax's Directorist, a WordPress listings plugin. All versions up to and including 8.10.6 are affected; the issue is present from an undisclosed initial release through 8.10.6.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is unavailable, which means we cannot quantify current exploit probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it via any web interface that accepts user input for listings or descriptions, making the vulnerability readily exploitable by anyone able to submit or edit content. The attack vector is web‑based and does not require privileged access.