The WP Directory Kit WordPress plugin prior to version 1.5.8 contains a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of category and location fields. Users assigned a WP Directory Kit-specific listing-management role, even without unfiltered_html capability, can inject malicious scripts into these fields. These scripts execute in the context of any visitor viewing the affected page, potentially leading to session hijacking, defacement, or other script-based attacks.

An attacker with the listing-management role in WP Directory Kit can perform stored XSS attacks that execute arbitrary JavaScript in the browsers of visitors to the affected pages. This can lead to theft of cookies, session tokens, or other sensitive information, as well as unauthorized actions performed on behalf of the visitor. The vulnerability affects all visitors to the compromised pages, increasing the risk of widespread impact.

Upgrade the WP Directory Kit plugin to version 1.5.8 or later, where this vulnerability is fixed. Since the plugin is not a cloud service and no official patch link is provided in the data, users should verify the availability of the fixed version from the official plugin repository or vendor site. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.