{
 "id": "WPSEC-2026-2730",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2730/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2730/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2730/index.md",
 "title": "WP Directory Kit <= 1.5.9 - Authenticated (Listing Admin+) Stored Cross-Site Scripting via Search Suggestions",
 "description": "The WP Directory Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the front-end search suggestion feature in all versions up to, and including, 1.5.9. The server returns listing data such as the address without escaping it (and the address is only filtered with wp_kses_post when saved), and wdk_suggestion.js builds the suggestion list by joining strings into HTML, including single-quoted attribute values. This makes it possible for authenticated attackers, with Listing Admin-level access and above, to inject arbitrary web scripts into listing data that execute when a user sees the matching search suggestions.",
 "plugin": {
  "slug": "wpdirectorykit",
  "name": "WP Directory Kit",
  "full_name": "WP Directory Kit",
  "wordpress_org": "https://wordpress.org/plugins/wpdirectorykit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdirectorykit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdirectorykit"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-11-06T20:47:36+00:00",
 "published": "2026-11-07T21:41:07+00:00",
 "updated": "2026-11-07T11:11:35.855448+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2730/",
  "https://plugins.svn.wordpress.org/wpdirectorykit/tags/1.6.1/",
  "https://wordpress.org/plugins/wpdirectorykit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdirectorykit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}