Description
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
Published: 2026-08-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated Cross Site Scripting (XSS) exists in the WordPress Business Directory plugin versions 6.4.25 and earlier, allowing an attacker to inject arbitrary script code into the web pages presented to visitors. The flaw arises from insufficient input validation, classified under CWE‑79, and can lead to client‑side script execution without requiring user authentication.

Affected Systems

The vulnerability affects the Strategy11 Team Business Directory plugin for WordPress. All installations running version 6.4.25 or older are impacted, as the issue was remediated in the subsequent 6.4.26 release.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. Attackers do not need prior authentication; any visitor to the affected site can trigger the fault, potentially compromising the session integrity of other users and allowing widespread script execution across the website.

Generated by OpenCVE AI on August 13, 2026 at 16:36 UTC.

Remediation

Vendor Solution

Update the WordPress Business Directory plugin to the latest available version (at least 6.4.26).

OpenCVE Recommended Actions

  • Update the Business Directory plugin to version 6.4.26 or newer.
  • If an immediate update is not possible, disable the plugin or restrict its use to trusted administrative roles until a patch is applied.
  • Deploy a web application firewall rule to block known XSS payloads and sanitize injected script content as a temporary mitigation.

Generated by OpenCVE AI on August 13, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Strategy11team
Strategy11team business Directory Plugin
Wordpress
Wordpress wordpress
Vendors & Products Strategy11team
Strategy11team business Directory Plugin
Wordpress
Wordpress wordpress

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
Title WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Strategy11team Business Directory Plugin
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-13T15:22:41.117Z

Reserved: 2026-02-25T12:13:06.634Z

Link: CVE-2026-28004

cve-icon Vulnrichment

Updated: 2026-08-13T15:22:34.992Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T14:16:57.560

Modified: 2026-08-14T19:09:20.713

Link: CVE-2026-28004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T12:15:42Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')