CVE-2026-28004 in Business Directory Plugin
Summary
by MITRE • 08/13/2026
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical security flaw in the Business Directory plugin for WordPress systems, where unauthenticated users can inject malicious scripts into web pages viewed by other users. The issue stems from inadequate input validation and output escaping mechanisms within the plugin's codebase, specifically affecting versions up to and including 6.4.25. The vulnerability manifests when user-supplied data is directly incorporated into HTML responses without proper sanitization, creating an environment where attackers can execute arbitrary JavaScript code in the context of victim browsers.
The technical implementation of this cross site scripting flaw occurs through various entry points within the plugin's functionality, particularly in areas that handle user-generated content such as business listings, contact forms, or directory search parameters. Attackers can exploit this weakness by crafting malicious payloads that leverage stored or reflected XSS vectors to persist their malicious scripts within the application's data storage or deliver them through crafted URLs. The vulnerability falls under CWE-79 which specifically addresses Cross Site Scripting flaws in software applications and aligns with ATT&CK technique T1059.002 for command and scripting interpreter usage through web shells and malicious script execution.
The operational impact of this vulnerability extends beyond simple script injection, as it can enable attackers to hijack user sessions, steal sensitive information, manipulate data within the application, or redirect users to malicious websites. An attacker who successfully exploits this vulnerability could gain access to user accounts, modify business listings, or even escalate privileges if the affected WordPress installation lacks proper security hardening measures. The unauthenticated nature of the exploit means that no prior login credentials are required, making it particularly dangerous as it can be leveraged by anyone with access to the vulnerable website.
Organizations should implement immediate mitigations including updating to the latest version of the Business Directory plugin where the XSS vulnerability has been patched, applying proper input validation and output escaping mechanisms, and implementing Content Security Policy headers to limit script execution. Additionally, security measures such as web application firewalls, regular security audits, and user access controls should be strengthened to prevent exploitation. The remediation process must include thorough code review of all user input handling mechanisms and implementation of proper sanitization routines to prevent similar vulnerabilities from emerging in other components of the system.