{"id":"CVE-2026-122661","kind":"vulnerability","aliases":["CVE-2026-122661"],"related":[],"title":"Directorist WordPress plugin: stored XSS through input handling, up to 8.10.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.","summary":"Directorist, a WordPress directory plugin by wpWax, does not sanitize some user input before it is rendered in pages. An attacker can store a script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `8.10.7`; versions up to and including `8.10.7` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:43+00:00","updated_at":"2026-11-09T11:26:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Directorist WordPress plugin: stored XSS through input handling, up to 8.10.7","impact":"medium","summary":"Directorist, a WordPress directory plugin by wpWax, does not sanitize some user input before it is rendered in pages. An attacker can store a script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Find the fixed version and affected input fields in the wpWax Directorist changelog or the NVD entry for CVE-2026-122661.","how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `8.10.7`; versions up to and including `8.10.7` are listed as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Directorist WordPress plugin up to version 8.10.7 are in scope. Exposure depends on who can submit content that gets rendered to other visitors, and the sources do not say which input fields are involved. Sites not running Directorist can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4537,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122661':14A,17A '-2026':13A,16A '8.10.7':11A,81C 'affect':76C 'allow':72C 'attack':44B 'browser':54B 'cross':64C 'cross-sit':63C 'cve':12A,15A 'directori':27B 'directorist':1A,18B,24B,70C,71C,77C 'generat':62C 'handl':8A 'host':22B 'improp':55C 'input':7A,36B,58C 'issu':75C 'n/a':79C 'neutral':56C 'packag':19B 'page':42B,61C 'plugin':3A,28B 'render':40B 'run':50B 'sanit':33B 'script':48B,66C 'self':21B 'self-host':20B 'site':65C 'store':4A,46B,73C 'user':35B 'visitor':53B 'vulner':67C 'web':60C 'wordpress':2A,23B,26B 'wpwax':30B,69C 'xss':5A 'xss.this':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin up to version 8.10.7 are in scope. Exposure depends on who can submit content that gets rendered to other visitors, and the sources do not say which input fields are involved. Sites not running Directorist can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-122661':14A,17A '-2026':13A,16A '8.10.7':11A 'cve':12A,15A 'directorist':1A 'handl':8A 'input':7A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'attack':44B 'browser':54B 'directori':27B 'directorist':18B,24B 'host':22B 'input':36B 'packag':19B 'page':42B 'plugin':28B 'render':40B 'run':50B 'sanit':33B 'script':48B 'self':21B 'self-host':20B 'store':46B 'user':35B 'visitor':53B 'wordpress':23B,26B 'wpwax':30B","search_c":"'8.10.7':81C 'affect':76C 'allow':72C 'cross':64C 'cross-sit':63C 'directorist':70C,71C,77C 'generat':62C 'improp':55C 'input':58C 'issu':75C 'n/a':79C 'neutral':56C 'page':61C 'script':66C 'site':65C 'store':73C 'vulner':67C 'web':60C 'wpwax':69C 'xss.this':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122661","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}