Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting

2026-06-29 00:00

she11f

Strategic Overview

Status

Patched in 6.4.23

Affected PluginBusiness Directory Plugin – Easy Listing Directories for WordPress

Affected Version<= 6.4.22

CVSS6.4Medium

CVECVE-2026-57328

View all Business Directory Plugin – Easy Listing Directories for WordPress vulnerabilities

Vulnerability Overview

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Technical Analysis

REMEDIATION: Update to version 6.4.23, or a newer patched version --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

External References

https://www.cve.org/CVERecord?id=CVE-2026-57328 https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4c745b-f489-417c-8004-ead131a7a6c6