CVE-2026-100185 wpwax CVE debrief

Who should care

WordPress site administrators and defenders using the Directorist plugin should assess exposure and apply necessary updates or mitigations. Subscriber-level users with the edit_at_biz_dirs and publish_at_biz_dirs capabilities are also affected.

Why it matters

CVE-2026-100185 is a medium-severity vulnerability in the Directorist plugin for WordPress, allowing authenticated Stored Cross-Site Scripting via the 'phone' Listing Field. Defenders should assess exposure, verify capabilities, monitor activity, and prioritize remediation.

• Defenders should verify if their WordPress sites use the Directorist plugin version 8.10.2.1 or earlier.
• Site administrators need to assess if subscriber-level users have the edit_at_biz_dirs and publish_at_biz_dirs capabilities.
• Defenders should monitor for suspicious activity, especially injections of arbitrary web scripts.
• Remediation priority is medium; apply updates or patches provided by the vendor, wpwax, as soon as available.

Technical summary

The Directorist plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'phone' Listing Field. This allows authenticated attackers with subscriber-level access to inject web scripts, which execute when a user accesses an injected page. The vulnerability exists in versions up to and including 8.10.2.1. The plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, enabling any subscriber-level user to submit and publish listings without moderation. Defenders should assess exposure, verify capabilities, and prioritize remediation.

Defensive priority

Medium priority for WordPress site administrators and defenders, especially those using the Directorist plugin, to assess exposure and apply necessary updates or mitigations.

Recommended defensive actions

• Assess exposure by checking if the Directorist plugin version is 8.10.2.1 or earlier.
• Verify if subscriber-level users have the edit_at_biz_dirs and publish_at_biz_dirs capabilities.
• Apply updates or patches provided by the vendor, wpwax, as soon as available.
• Monitor for suspicious activity, especially injections of arbitrary web scripts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code. However, there is limited information on exploitation, impact, or remediation beyond the CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.