CVE-2026-16591CWE-79cross-site-scripting

CVE-2026-16591

High · published September 26, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-26T11:17Z
References (1)
https://wpscan.com/vulnerability/7b5600f1-1024-4329-97de-6347420e46c1/ · [email protected]
EPSS history
Timeline
  • 27 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 06:00Z
    WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
    cvelistv5