CVE-2026-86817
Received Received - Intake

Five Star Business Profile Schema XSS Vulnerability

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: WPScan

Description
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-86817
EUVD
EUVD-2026-92074

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
five_star_business_profile_and_schema 2.3.20 *
five_star_business_profile_and_schema 2.3.21 From 2.3.20 (inc) to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Five Star Business Profile and Schema WordPress plugin before version 2.4.0. It allows authenticated users with Author-level access or higher to exploit improperly restricted schema field default callbacks. This can lead to storing sensitive data like other users' password hashes and site option values in public output, which is accessible to unauthenticated visitors.

Detection Guidance

Check the installed version of the Five Star Business Profile and Schema plugin. If it is below 2.4.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If you use the Five Star Business Profile and Schema plugin versions 2.3.20 to 2.3.21, attackers with Author-level access could expose sensitive data such as password hashes and site settings. This could lead to unauthorized access, data breaches, or further exploitation of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive user data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Five Star Business Profile and Schema plugin to version 2.4.0 or later immediately. Restrict Author-level user access to only necessary functions and review stored sensitive data in public output.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart