CVE-2026-122661: WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector requires network access, low privileges, and user interaction. The provided data does not identify the specific role or feature through which the low-privileged attacker submits the malicious input.

Q: What is the potential impact if the vulnerability is exploited?

This is a stored XSS issue with low confidentiality, integrity, and availability impact. Its scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

Q: Which Directorist versions are affected?

Directorist versions through 8.10.7 are affected. The available data does not identify a fixed version or a mitigation for environments that cannot update immediately.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.

Affected Software

1 affected component

wpWax Directorist<=8.10.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wpWax Directorist to a version that resolves this vulnerability.
Fixed in 8.11

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector requires network access, low privileges, and user interaction. The provided data does not identify the specific role or feature through which the low-privileged attacker submits the malicious input.

What is the potential impact if the vulnerability is exploited?

This is a stored XSS issue with low confidentiality, integrity, and availability impact. Its scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

Which Directorist versions are affected?

Directorist versions through 8.10.7 are affected. The available data does not identify a fixed version or a mitigation for environments that cannot update immediately.

CVE-2026-122661: WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if the vulnerability is exploited?

Which Directorist versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if the vulnerability is exploited?

Which Directorist versions are affected?