ByteOS Network

CVE Vulnerability Details :

CVE-2026-25004

PUBLISHED

More Info Official Page

Assigner-Patchstack

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-19 Feb, 2026 | 08:26

Updated At-19 Feb, 2026 | 08:26

▼CVE Numbering Authority (CNA)

WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.

Affected Products

Vendor

CreativeMindsSolutions

Product

CM Business Directory

Collection URL

https://wordpress.org/plugins

Package Name

cm-business-directory

Default Status

unaffected

Versions

Affected

From n/a through <= 1.5.3 (custom)
- -> unaffectedfrom1.5.4

Problem Types

Type	CWE ID	Description
CWE	CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impacts

CAPEC ID	Description
CAPEC-592	Stored XSS

CAPEC ID: CAPEC-592

Description: Stored XSS

Credits

finder

Arif Shaikh | Patchstack Bug Bounty Program

References

Hyperlink	Resource
https://patchstack.com/database/Wordpress/Plugin/cm-business-directory/vulnerability/wordpress-cm-business-directory-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/Wordpress/Plugin/cm-business-directory/vulnerability/wordpress-cm-business-directory-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve

Resource:

vdb-entry

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References