CVE-2026-16591: WP Directory Kit WordPress XSS Vulnerability

CVE-2026-16591 Overview

CVE-2026-16591 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Directory Kit WordPress plugin versions prior to 1.5.8. The plugin fails to sanitize and escape category and location fields before rendering them in page attributes. Users holding the plugin-specific listing-management role can inject malicious JavaScript, even without the unfiltered_html capability. The injected payload executes in the browser of every visitor to the affected page. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with listing-management permissions can persist JavaScript that executes against all site visitors, enabling session theft, account takeover, and content manipulation.

Affected Products

WP Directory Kit WordPress plugin versions before 1.5.8
WordPress sites exposing the plugin's listing-management role to lower-trust users
Public directory pages rendering category and location fields managed by the plugin

Discovery Timeline

2026-09-26 - CVE-2026-16591 published to the National Vulnerability Database
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-16591

Vulnerability Analysis

The vulnerability resides in how WP Directory Kit handles user-supplied text for category and location fields. The plugin writes these values directly into page attribute contexts without applying WordPress escaping functions such as esc_attr() or esc_html(). An authenticated user with the listing-management role can submit payloads containing JavaScript event handlers or script fragments. When any visitor loads the affected directory page, the browser parses the attacker-controlled attribute and executes the embedded code.

This is a stored XSS: payloads persist in the WordPress database and fire on every page view until removed. Because the attack targets anonymous visitors and authenticated administrators alike, an attacker can hijack administrator sessions, exfiltrate cookies, redirect users, or modify page content. See the WPScan Vulnerability Report for additional technical context.

Root Cause

The root cause is missing output encoding. The plugin trusts input from users who hold its custom listing-management role, bypassing the standard WordPress gate that requires the unfiltered_html capability for raw HTML submission. Because category and location values flow into HTML attribute contexts, the correct remediation requires contextual attribute escaping on output.

Attack Vector

An attacker first obtains, or compromises, an account with the WP Directory Kit listing-management role. The attacker then creates or edits a listing and injects a JavaScript payload into a category or location field. The plugin stores the payload and renders it unsanitized inside page attributes. Every subsequent visitor executes the payload in the context of the vulnerable site's origin.

See the WPScan Vulnerability Report for proof-of-concept details.

Detection Methods for CVE-2026-16591

Indicators of Compromise

Listing records in the WordPress database containing <script>, onerror=, onload=, or javascript: strings within category or location fields
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from directory pages
New or modified administrator accounts following visits to affected directory pages
Browser console errors or unexpected script loads on pages rendered by WP Directory Kit

Detection Strategies

Query the wp_posts and plugin-specific tables for category and location values containing HTML tags or JavaScript event handlers
Inspect rendered HTML of directory pages for script content inside attributes such as title, data-*, or style
Audit WordPress user accounts assigned the WP Directory Kit listing-management role for recent listing modifications
Review web server access logs for POST requests to plugin endpoints containing encoded < or > characters

Monitoring Recommendations

Enable WordPress audit logging to track listing creation and modification events by role
Monitor Content Security Policy (CSP) violation reports for inline script execution on directory pages
Alert on changes to privileged user accounts shortly after listing edits
Track installed plugin versions across managed WordPress sites to confirm 1.5.8 or later is deployed

How to Mitigate CVE-2026-16591

Immediate Actions Required

Upgrade WP Directory Kit to version 1.5.8 or later on all WordPress installations
Review and audit all accounts assigned the plugin's listing-management role and revoke access where not required
Inspect existing listings for malicious content in category and location fields and remove any payloads
Rotate credentials for administrator accounts that may have viewed compromised directory pages

Patch Information

The vendor fixed CVE-2026-16591 in WP Directory Kit version 1.5.8. The patch adds proper output escaping for category and location fields rendered in page attributes. Refer to the WPScan Vulnerability Report for release details and vendor references.

Workarounds

Temporarily deactivate WP Directory Kit if an immediate upgrade to 1.5.8 is not possible
Restrict the listing-management role to fully trusted users until the patch is applied
Deploy a Content Security Policy that disallows inline scripts on directory pages to reduce payload execution risk
Place a web application firewall rule in front of plugin submission endpoints to block HTML tag characters in category and location parameters

bash

# Upgrade WP Directory Kit using WP-CLI
wp plugin update wp-directory-kit --version=1.5.8

# Verify installed version
wp plugin get wp-directory-kit --field=version

# List users holding the plugin's listing-management role for review
wp user list --role=wp_directory_kit_manager --fields=ID,user_login,user_email