CVE-2026-16591

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8

Description Insufficient sanitization and escaping of category and location fields before they are output in page attributes allows users with a listing-management role to perform Stored Cross-Site Scripting (XSS) attacks. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server and executed in the browser of any visitor viewing the affected page.

Recommendations Update WP Directory Kit WordPress plugin to version 1.5.8 or later.