{"id":"CVE-2026-119497","kind":"vulnerability","aliases":["CVE-2026-119497"],"related":[],"title":"Directorist WordPress plugin: stored XSS through 8.10.6 lets attackers inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.","summary":"Directorist, a WordPress directory plugin by wpWax, does not sanitize some input before rendering it in pages, so stored cross-site scripting is possible. An attacker who can submit that input can run JavaScript in the browsers of people who view the page, which can include site administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"directorist","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["directorist","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-above-8.10.6"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins, or in the `directorist` plugin header.\n- Confirm whether the version is `8.10.6` or earlier.","fix":null,"status":"open","published_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:25+00:00","updated_at":"2026-11-09T10:26:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T10:26:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Directorist WordPress plugin: stored XSS through 8.10.6 lets attackers inject scripts","impact":"medium","summary":"Directorist, a WordPress directory plugin by wpWax, does not sanitize some input before rendering it in pages, so stored cross-site scripting is possible. An attacker who can submit that input can run JavaScript in the browsers of people who view the page, which can include site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Find the fixed Directorist version and the affected input fields from the wpWax changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119497.","how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins, or in the `directorist` plugin header.\n- Confirm whether the version is `8.10.6` or earlier.","plain_action":"","product_name":"directorist","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-8.10.6"],"who_is_affected":"Sites running the Directorist WordPress plugin version 8.10.6 or earlier are the ones the sources cover. Exposure depends on whether untrusted users can submit content that is later displayed to others, such as listings or forms; the sources do not say which inputs are affected or whether the site must allow public submissions.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4537,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119497':14A,17A '-2026':13A,16A '8.10.6':7A,100C 'administr':73B 'affect':95C 'allow':91C 'attack':9A,51B 'browser':62B 'cross':45B,83C 'cross-sit':44B,82C 'cve':12A,15A 'directori':28B 'directorist':1A,18A,19B,25B,89C,90C,96C 'generat':81C 'host':23B 'improp':74C 'includ':71B 'inject':10A 'input':36B,56B,77C 'issu':94C 'javascript':59B 'let':8A 'n/a':98C 'neutral':75C 'packag':20B 'page':41B,68B,80C 'peopl':64B 'plugin':3A,29B 'possibl':49B 'render':38B 'run':58B 'sanit':34B 'script':11A,47B,85C 'self':22B 'self-host':21B 'site':46B,72B,84C 'store':4A,43B,92C 'submit':54B 'view':66B 'vulner':86C 'web':79C 'wordpress':2A,24B,27B 'wpwax':31B,88C 'xss':5A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin version 8.10.6 or earlier are the ones the sources cover. Exposure depends on whether untrusted users can submit content that is later displayed to others, such as listings or forms; the sources do not say which inputs are affected or whether the site must allow public submissions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["directorist"],"ptokens":["directorist"],"labels":["directorist","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-119497':14A,17A '-2026':13A,16A '8.10.6':7A 'attack':9A 'cve':12A,15A 'directorist':1A,18A 'inject':10A 'let':8A 'plugin':3A 'script':11A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'administr':73B 'attack':51B 'browser':62B 'cross':45B 'cross-sit':44B 'directori':28B 'directorist':19B,25B 'host':23B 'includ':71B 'input':36B,56B 'javascript':59B 'packag':20B 'page':41B,68B 'peopl':64B 'plugin':29B 'possibl':49B 'render':38B 'run':58B 'sanit':34B 'script':47B 'self':22B 'self-host':21B 'site':46B,72B 'store':43B 'submit':54B 'view':66B 'wordpress':24B,27B 'wpwax':31B","search_c":"'8.10.6':100C 'affect':95C 'allow':91C 'cross':83C 'cross-sit':82C 'directorist':89C,90C,96C 'generat':81C 'improp':74C 'input':77C 'issu':94C 'n/a':98C 'neutral':75C 'page':80C 'script':85C 'site':84C 'store':92C 'vulner':86C 'web':79C 'wpwax':88C 'xss.this':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119497","severity":null,"published_at":"2026-11-09T10:17:05+00:00","modified_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}