CVE-2026-100185: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the editatbizdirs and publishatbizdirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with subscriber-level access or higher. In affected versions, subscribers receive the edit_at_biz_dirs and publish_at_biz_dirs capabilities, allowing them to submit and publish listings without moderation.
Which installations are exposed by default?
Installations running Directorist versions up to and including 8.10.2.1 are affected where subscriber accounts can use the plugin's listing capabilities. The issue is specifically reachable through the phone field of a listing.
What happens after a malicious listing is published?
Script injected into the phone listing field is stored and executes in a visitor's browser when they access the affected listing page. The vulnerability can affect confidentiality and integrity in the context of the user viewing that page.
What can be done if updating is not immediately possible?
Restrict or remove untrusted subscriber access to Directorist listing creation and publishing, particularly the edit_at_biz_dirs and publish_at_biz_dirs capabilities. Review existing listings, including phone fields, for injected script content and remove suspicious entries.