The WP Directory Kit WordPress plugin prior to version 1.5.8 does not sanitize and escape the category and location title and icon fields before rendering them as page attributes. Consequently, users who possess the listing‑management role but lack the unfiltered_html capability can inject arbitrarily complex HTML or JavaScript. When visitors load the affected page, the stored payload executes in the victim’s browser, enabling defacement, data theft, or session hijacking.

This vulnerability applies to any WordPress installation using WP Directory Kit plugin versions earlier than 1.5.8. The exact plugin name and product are listed as “Unknown:WP Directory Kit” in the vendor data, but the issue is tied solely to the plugin’s internal category and location handling.

The official CVSS score is 7.2, and the EPSS score is available at < 1%, which limits a precise risk quantification. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires the adversary to have build‑time or privileged access to populate the untrusted fields; however, the resulting stored script executes for any visitor to the page, making the attack impact broad once the payload is injected. The absence of zero‑day exploits in the public domain suggests a moderate exploitability, but the potential damage remains high due to the web‑browser context.