The Directorist plugin is vulnerable to stored cross‑site scripting because it fails to properly neutralize user input when rendering content. Based on the description, it is inferred that an attacker can inject JavaScript or other malicious code that will execute in the browsers of other site visitors, potentially enabling session hijacking, defacement, or other credential‑stealing attacks. The weakness relies on improper input validation, corresponding to CWE‑79.

WordPress sites that use the wpWax Directorist plugin version 8.10.7 or earlier are affected. The impact range is from the earliest available release through 8.10.7; any installation of a version in that range may be vulnerable.

Based on the description, it is inferred that attackers can exploit this vulnerability using the plugin’s data entry interfaces; any user that views the affected content will have the injected script executed. The CVSS score of 6.5 indicates a medium severity vulnerability, and the EPSS is not available, so the exploitation probability is currently unknown. This vulnerability is not listed in the CISA KEV catalog. The potential impact ranges from data theft to site compromise depending on the attacker’s privilege and the victim’s role.