Unauthenticated Cross Site Scripting in Business Directory

Executive Summary

The WordPress Business Directory Plugin, versions 6.4.22 and earlier, is vulnerable to a Cross Site Scripting (XSS) attack. This means attackers can inject malicious scripts into the website, which execute when visitors access the site.

The vulnerability is classified as medium priority with a CVSS score around 6.1 to 6.5, indicating moderate danger. Exploitation requires a privileged user to perform an action such as clicking a malicious link or submitting a form.

Injected scripts can include redirects or advertisements, potentially compromising the website's integrity and user experience.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to attackers injecting malicious scripts that execute in the context of your website, potentially redirecting visitors to harmful sites or displaying unwanted advertisements.

Such attacks can damage your website's reputation, degrade user trust, and may lead to further exploitation if attackers gain additional access.

Because exploitation requires a privileged user to interact with malicious content, social engineering or phishing tactics might be used to trigger the attack.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the WordPress Business Directory Plugin versions 6.4.22 and earlier can be mitigated by updating the plugin to version 6.4.23 or later, where the issue is patched.

Until the update is applied, it is advised to implement the mitigation rule issued by Patchstack to block attacks targeting this vulnerability.

Useful 0 Not Useful 0