This vulnerability, identified as CWE-79, is a cross-site scripting (XSS) issue in Strategy11 Team's Business Directory plugin for WordPress. It affects versions up to 6.4.24 and allows a subscriber-level user to inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, user interaction needed, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium with partial confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting subscriber input or applying web application firewall rules to detect and block XSS payloads related to this plugin. Monitor vendor channels for updates.