https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 09:42:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-100185 <p>The Directorist: AI-Powered Business Directory, Listings &amp; Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;phone&#39; Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.</p> <p>The Directorist: AI-Powered Business Directory, Listings &amp; Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;phone&#39; Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.</p> https://db.gcve.eu/vuln/fkie_cve-2026-100185 https://db.gcve.eu/vuln/ghsa-v6w7-4jw7-37cj <p>The Directorist: AI-Powered Business Directory, Listings &amp; Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;phone&#39; Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.</p> <p>The Directorist: AI-Powered Business Directory, Listings &amp; Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;phone&#39; Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.</p> https://db.gcve.eu/vuln/ghsa-v6w7-4jw7-37cj