CVE-2026-100185

Executive Summary

CVE-2026-100185 is a stored cross-site scripting (XSS) vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress, affecting all versions up to and including 8.10.2.1. The flaw exists because the plugin fails to properly sanitize input and escape output for the 'phone' listing field, and it grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any authenticated subscriber to submit and publish listings without moderation. Successful exploitation permits an attacker with subscriber-level access or higher to inject arbitrary JavaScript that executes in the context of any user viewing the affected listing page, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site and its users.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting issue classified under CWE-79. It arises from insufficient input sanitization and output escaping of the 'phone' field within a Directorist listing. The plugin exposes this field through the listing submission and editing interface. Because the plugin assigns the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the WordPress subscriber role, any authenticated user with subscriber-level access can create and publish a listing (or edit an existing one) without administrative review. When a malicious payload is saved in the 'phone' field, it is stored in the WordPress database. Upon rendering the listing page, the plugin outputs the field value without proper HTML entity encoding or contextual escaping, causing the browser to interpret and execute the injected script. The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network exploitable, low attack complexity, low privileges required, no user interaction, scope changed, and low confidentiality and integrity impact, with no availability impact. The scope change (S:C) reflects that the vulnerable component (the plugin) can affect resources beyond its security scope, such as the broader WordPress site and user sessions. No public proof-of-concept or exploit code is currently available, and the vulnerability remains unpatched.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the technical details provided. 1) Reconnaissance: An attacker identifies a WordPress site running the Directorist plugin, version 8.10.2.1 or earlier, by inspecting the site's front-end (e.g., directory listing pages) or using search engine dorks. 2) Authentication: The attacker registers a subscriber-level account on the target site, or compromises an existing low-privileged account. 3) Payload Delivery: Leveraging the subscriber-level capabilities edit_at_biz_dirs and publish_at_biz_dirs, the attacker navigates to the listing submission or edit interface and enters a crafted JavaScript payload into the 'phone' field of a listing. 4) Publication: Because the plugin allows subscribers to publish listings without moderation, the listing containing the malicious script becomes immediately live. 5) Execution: When any user (including administrators or other visitors) views the affected listing page, the stored script executes in their browser under the context of the vulnerable site. 6) Post-Exploitation: The attacker can steal session cookies, perform actions on behalf of the victim (e.g., create admin accounts, modify content), redirect users to malicious sites, or deliver further client-side attacks. The lack of user interaction (UI:N) means the victim only needs to view the page for the script to run.

Impact Assessment

The business impact includes potential compromise of user sessions, theft of sensitive data (such as authentication cookies or personal information), defacement of the website, and redirection of visitors to malicious domains. Because the vulnerability allows any subscriber to publish listings, a low-privileged attacker can easily inject persistent scripts, affecting a broad user base including administrators. The CVSS score of 6.4 (Medium) reflects the network-based attack vector, low complexity, low privileges required, and the scope change that enables the attacker to impact resources beyond the plugin itself. The confidentiality and integrity impacts are rated Low, indicating partial loss of data and modification of content, but the potential for session hijacking and lateral movement within the WordPress installation raises the effective risk. The blast radius includes all visitors to the compromised listing page and potentially the entire WordPress site if an administrator is targeted. No availability impact is expected.

Detection Guidance

Sigma Rule

title: Stored XSS in Directorist 'phone' Listing Field
id: 7a3b5c1d-2e4f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts via the 'phone' field in Directorist plugin listings.
author: Threat Intelligence
date: 2026-05-20
logsource:
  category: web
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: '/wp-admin/admin-ajax.php'
    cs-uri-query|contains: 'action=directorist_'
    cs-referer|contains: 'directorist'
  keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
  condition: selection and keywords
falsepositives:
  - Legitimate use of HTML in phone field (unlikely)
level: high
tags:
  - attack.t1059.007
  - cve.2026-100185

YARA Rule

rule CVE_2026_100185_Directorist_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads in Directorist 'phone' listing field"
        author = "Threat Intelligence"
        date = "2026-05-20"
        reference = "CVE-2026-100185"
        severity = "high"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "javascript:" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
        $phone_field = "phone" nocase
    condition:
        any of ($xss*) and $phone_field
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-100185 Directorist Stored XSS via phone field"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=directorist_"; http_uri; content:"phone"; http_client_body; pcre:"/(<script|javascript:|onerror=|onload=)/i"; classtype:web-application-attack; sid:10018501; rev:1; reference:cve,2026-100185;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query contains "action=directorist_" and
    http.request.body contains "phone" and
    (http.request.body contains "<script" or http.request.body contains "javascript:" or http.request.body contains "onerror=") ]
  [ network where network.protocol == "http" and http.request.method == "GET" and
    url.path contains "/directory/" and
    http.response.body contains "<script" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri="/wp-admin/admin-ajax.php*action=directorist_*" form_data="*phone*"
| regex form_data="(?i)(<script|javascript:|onerror=|onload=)"
| table _time, src_ip, user, uri, form_data, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100185" level="12">
    <if_sid>31100</if_sid>
    <match>POST /wp-admin/admin-ajax.php</match>
    <regex>action=directorist_.*phone=.*(&lt;script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-100185: Directorist stored XSS attempt via phone field</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_100185,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). 1) Immediate mitigations: Restrict the edit_at_biz_dirs and publish_at_biz_dirs capabilities to trusted roles only (e.g., administrator, editor) by using a role management plugin or custom code that removes these capabilities from the subscriber role. Consider disabling the Directorist plugin if it is not business-critical until a patch is available. Implement a Web Application Firewall (WAF) rule to block requests containing script tags or event handlers in the 'phone' parameter. Enforce Content Security Policy (CSP) headers to mitigate script execution. 2) Patch/upgrade steps: Monitor the vendor's official channel for a security update. Once released, update the Directorist plugin to the patched version immediately. Verify the update by checking the plugin changelog and testing the 'phone' field for proper sanitization. 3) Long-term hardening: Apply the principle of least privilege to user roles; avoid granting publishing capabilities to low-privileged users. Regularly audit plugins for unnecessary capabilities. Sanitize and escape all user-supplied input on output, using WordPress functions like esc_html() and esc_attr(). Conduct secure code reviews and implement automated security testing in the development lifecycle.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-100185
• https://wordpress.org/plugins/directorist/ (vendor plugin page)
• https://cwe.mitre.org/data/definitions/79.html (CWE-79: Improper Neutralization of Input During Web Page Generation)
• https://attack.mitre.org/techniques/T1059/007/ (MITRE ATT&CK T1059.007)
• EPSS Score: 0.00252 (15.6th percentile) as of report date. No known threat actor campaigns or exploit-in-the-wild evidence at this time. CISA KEV: NO.