# Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Map Info Window Phone Number and Coordinates

- **ID:** WPSEC-2026-0486
- **Plugin:** Directorist: AI-Powered Business Directory, Listings & Classified Ads (`directorist`), https://wordpress.org/plugins/directorist/
- **Affected versions:** all versions before 8.10.1
- **Fixed in:** 8.10.1 (Update to 8.10.1 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/directorist
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0486/

## Description

The Directorist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing phone number and map coordinates shown in the single listing map info window in all versions up to, and including, 8.10. This is due to insufficient output escaping of these values when they are placed into link attributes and content. This makes it possible for authenticated attackers with subscriber-level access and above who can submit listings (or unauthenticated attackers when guest submission is enabled) to inject arbitrary web scripts that execute when a user views the listing's map info window.

## References

- https://wpsec.com/vuln/WPSEC-2026-0486/
- https://plugins.svn.wordpress.org/directorist/tags/8.10.1/
- https://wordpress.org/plugins/directorist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0486/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.