This vulnerability, identified as CWE-79, is a Cross-Site Scripting (XSS) flaw in the Business Directory plugin by Strategy11 Team. It affects all versions up to and including 6.4.24. The issue arises from improper neutralization of input during web page generation, which could allow a subscriber-level user to inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No official remediation or patch has been documented yet.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. This could result in session hijacking, information disclosure, or other client-side attacks within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber input capabilities or applying web application firewall (WAF) rules to detect and block suspicious script injections related to this vulnerability.