CVE-2026-100185 Overview
CVE-2026-100185 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress. The flaw affects all versions up to and including 8.10.2.1. It stems from insufficient input sanitization and output escaping of the phone listing field. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when any user views an affected page. The plugin compounds the risk by granting the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the WordPress subscriber role, allowing unmoderated listing submissions.
Critical Impact
Any registered subscriber can publish listings containing persistent JavaScript payloads that execute in the browser of every visitor, including administrators.
Affected Products
- Directorist WordPress plugin versions ≤ 8.10.2.1
- WordPress sites using the plugin's default subscriber capability grants
- Any page rendering the phone field from the Directorist Single Listing model or map template
Discovery Timeline
- 2026-10-14 - CVE CVE-2026-100185 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-100185
Vulnerability Analysis
The vulnerability resides in how the Directorist plugin handles the phone field submitted through its listing creation workflow. User-supplied input flows from includes/classes/class-add-listing.php into the SingleListing model and is subsequently rendered by templates such as templates/single/fields/map.php without adequate escaping. Because the output path omits context-appropriate escaping functions like esc_html() or esc_attr(), HTML and JavaScript injected into the phone value are rendered as live markup.
The impact is amplified by a privilege configuration issue. The plugin assigns edit_at_biz_dirs and publish_at_biz_dirs to the WordPress subscriber role at activation. Subscribers can therefore publish listings directly, with no editorial review, turning a self-registration form into an injection channel. A single malicious listing can harvest session cookies, perform CSRF-style actions against administrators, or redirect visitors to attacker-controlled infrastructure.
Root Cause
The root cause is a combination of missing output escaping on the phone listing field and a permissive capability model. Input validation on submission does not strip script constructs, and the rendering templates emit the stored value into HTML contexts without sanitization. See the WordPress Directorist Change Set for the committed fix.
Attack Vector
An attacker registers a subscriber account on a target WordPress site running a vulnerable Directorist version. The attacker submits a new listing and places a JavaScript payload inside the phone field. Because subscribers can publish directly, the listing becomes live. When any visitor, including administrators, views the listing or a page embedding its map template, the stored payload executes in the browser under the site's origin.
Technical details are available in the Wordfence Vulnerability Report and the plugin source references for class-add-listing.php and SingleListing.php.
Detection Methods for CVE-2026-100185
Indicators of Compromise
- Listing records with <script>, onerror=, onload=, or javascript: substrings in the phone metadata column of the wp_postmeta table
- Newly created subscriber accounts followed quickly by at_biz_dir custom post type submissions
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after viewing a listing page
Detection Strategies
- Query wp_postmeta for meta_key values associated with the Directorist phone field and flag entries containing HTML tags or event-handler attributes
- Review web server logs for POST requests to Directorist listing submission endpoints originating from low-privilege accounts
- Audit the WordPress role configuration for the presence of edit_at_biz_dirs and publish_at_biz_dirs on the subscriber role
Monitoring Recommendations
- Enable WordPress audit logging to capture listing creation, user registration, and role changes
- Alert on Content Security Policy (CSP) violation reports triggered by inline script execution on directory listing pages
- Monitor for anomalous administrator session activity following visits to user-generated listing content
How to Mitigate CVE-2026-100185
Immediate Actions Required
- Update the Directorist plugin to a version newer than 8.10.2.1 that contains the fix referenced in the plugin change set
- Remove the edit_at_biz_dirs and publish_at_biz_dirs capabilities from the subscriber role if not strictly required
- Review and purge existing listings for malicious payloads in the phone field prior to re-enabling public access
Patch Information
The vendor committed the fix in the Directorist plugin repository. Review the WordPress Directorist Change Set and upgrade through the WordPress plugin management interface or by replacing the plugin directory with the patched release.
Workarounds
- Require moderation for all new listings by removing publish capabilities from untrusted roles and enforcing an administrator approval workflow
- Deploy a Web Application Firewall (WAF) rule to block listing submissions containing script tags or JavaScript event handlers in the phone parameter
- Apply a strict Content Security Policy that disallows inline scripts on pages rendering user-generated directory content
# Remove unsafe capabilities from the subscriber role via WP-CLI
wp cap remove subscriber edit_at_biz_dirs publish_at_biz_dirs
wp cap list subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
