CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields
medium
The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
- CVSS:
- 6.4
- Affected:
- up to 1.5.7
- Fixed in:
- 1.5.8
- Disclosed:
- Jul 2, 2026
CVE-2026-8892 on NVD →
CM Business Directory – Optimise and showcase local business [cm-business-directory] <= 1.5.3 (unfixed)
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.
- Affected:
- up to 1.5.3
- Fix:
- No patched version reported
- Disclosed:
- Feb 19, 2026
CVE-2026-25004 on NVD →
CM Business Directory – Optimise and showcase local business <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting
medium
The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, t...
- CVSS:
- 6.4
- Affected:
- up to 1.5.3
- Fixed in:
- 1.5.4
- Disclosed:
- Jan 16, 2026
CVE-2026-25004 on NVD →
CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...
- CVSS:
- 6.4
- Affected:
- up to 1.5.2
- Fixed in:
- 1.5.3
- Disclosed:
- Sep 25, 2025
CVE-2025-10178 on NVD →
CM Business Directory – Optimise and showcase local business [cm-business-directory] < 1.4.0
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8.
- Affected:
- up to 1.4.0
- Fixed in:
- 1.4.0
- Disclosed:
- Mar 3, 2025
CVE-2025-24758 on NVD →
CM Business Directory – Optimise and showcase local business [cm-business-directory] < 1.4.2
unknown
[en] Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...
- Affected:
- up to 1.4.2
- Fixed in:
- 1.4.2
- Disclosed:
- Nov 26, 2024
CVE-2024-11202 on NVD →
Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode
medium
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...
- CVSS:
- 6.1
- Affected:
- up to 1.4.1
- Fixed in:
- 1.4.2
- Disclosed:
- Nov 25, 2024
CVE-2024-11202 on NVD →
CM Business Directory – Optimise and showcase local business [cm-business-directory] < 1.5.3
unknown
- Affected:
- up to 1.5.3
- Fixed in:
- 1.5.3
CVE-2025-10178 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database