This vulnerability in CM Business Directory (<= 1.5.3) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges can inject malicious scripts that are stored and later executed in the context of other users, potentially leading to limited confidentiality and integrity compromise. The CVSS vector indicates network attack vector, low attack complexity, required privileges are high, user interaction is required, and the scope is changed.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in other users' browsers, potentially leading to limited disclosure or modification of information accessible to those users. There is no impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and carefully validate and sanitize inputs in the affected plugin. Monitor vendor channels for updates regarding patches or official mitigations.