CM Business Directory <= 1.5.7 Authenticated Stored XSS via Address Meta Fields (CVE-2026-6892)

Vulnerability Overview Vulnerability Name: CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields Vulnerability Type: Stored Cross-Site Scripting (XSS) CVSS Score: 6.4 (Medium) CVE ID: CVE-2026-6892 Release Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: Muhammad Yuda - DJ Scope of Impact Affected Software: CM Business Directory Affected Versions: <= 1.5.7 Vulnerability Description: The CM Business Directory plugin, in versions 1.5.7 and earlier, contains a stored cross-site scripting vulnerability. An attacker can inject arbitrary scripts via the business address meta fields; these scripts are executed when users visit the affected page. Because the malicious payload is stored in rather than , the capability restriction in WordPress does not apply. Consequently, even users at the Contributor level who lack this capability can inject executable HTML. Remediation Fixed Version: 1.5.8 or later Recommended Action: Upgrade to version 1.5.8 or later of the CM Business Directory plugin. Reference Links plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: cm-business-directory Is Fixed: Yes Fixed Version: 1.5.8 Related Recent Vulnerabilities 1. CM Business Directory - Optimise and showcase local business <= 1.5.3 - Authenticated (Author) Stored Cross-Site Scripting - CVE ID: CVE-2026-25004 - CVSS Score: 6.4 - Researcher: Arif Shaikh - Release Date: January 16, 2026 2. CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-10178 - CVSS Score: 6.4 - Researcher: theviper17y - Release Date: September 25, 2025 3. Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via crmds_free_guide Shortcode - CVE ID: CVE-2024-11202 - CVSS Score: 6.1 - Researcher: Peter Thaleikis - Release Date: November 25, 2024 Summary The CM Business Directory plugin, in versions 1.5.7 and earlier, contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts via the business address meta fields. Users are advised to upgrade to version 1.5.8 or later to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

CM Business Directory <= 1.5.7 Authenticated Stored XSS via Address Meta Fields (CVE-2026-6892)

More from this source