CVE-2026-100185: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads

CVE-2026-100185 is a stored cross-site scripting vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin. The flaw exists in the 'phone' listing field, where input is not properly sanitized or escaped on output. The plugin grants edit_at_biz_dirs and publish_at_biz_dirs capabilities to subscriber roles, enabling authenticated users with subscriber-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 8.10.2.1.

An attacker with subscriber-level access can inject persistent malicious scripts into listing pages, which execute in the browsers of users viewing those pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability requires authentication but no user interaction (no UI needed) beyond viewing the injected page. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level permissions to prevent unauthorized publishing or editing of listings, or disable the plugin if feasible. Monitor for updates from the vendor and apply official patches when released.