The CM Business Directory WordPress plugin is vulnerable to stored cross‑site scripting because input provided in its business address meta fields is neither sanitized nor properly escaped before being output. An authenticated user with contributor‑level rights or higher can inject arbitrary JavaScript into fields such as cmbdd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country. When another user views the affected business page, the malicious script executes in the victim’s browser. The stored payload resides in post meta rather than post_content, so WordPress’s unfiltered_html restriction does not protect these fields, allowing even users without that capability to inject executable code.

All WordPress sites that have the CM Business Directory plugin from Creative Minds Solutions installed in any version up to and including 1.5.7 are affected. The vulnerability arises from the plugin’s backend and frontend handling of business address meta fields, which allows code injection and execution within the context of the site’s pages.

The flaw carries a CVSS score in the medium‑severity range. The EPSS score is < 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to obtain contributor‑level privileges, inject malicious code into one of the address fields, and compel a user or visitor to load the affected business page. Based on the description, it is inferred that the attack vector is limited to the WordPress administrative UI and the public view of business listings.