CVE-2026-16591: WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfilteredhtml capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a WP Directory Kit-specific listing-management role. The attacker does not need the WordPress unfiltered_html capability.
Who is exposed to the stored payload?
Any visitor who loads an affected page where the malicious category or location title or icon field is output may execute the injected script.
What configurations are affected?
WP Directory Kit versions before 1.5.8 are affected when users with the plugin-specific listing-management role can modify the relevant category or location fields.