Cross-Site Scripting Vulnerability in CMSJunkie WP-BusinessDirectory Plugin
CVE-2025-68887

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP-businessdirectory
Vendor
CVE Published:
8 January 2026

What is CVE-2025-68887?

The WP-BusinessDirectory plugin by CMSJunkie is susceptible to a Cross-Site Scripting (XSS) vulnerability, which may allow attackers to inject malicious scripts into web pages viewed by users. This reflected XSS issue can be exploited through unsanitized user input passed in URLs, thus compromising site integrity and potentially leading to unauthorized actions on behalf of authentic users. Users of affected plugin versions should apply the necessary security updates to mitigate this risk.

Affected Version(s)

WP-BusinessDirectory <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-b...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien | Patchstack Bug Bounty Program
JSON
.
CVE-2025-68887 : Cross-Site Scripting Vulnerability in CMSJunkie WP-BusinessDirectory Plugin