CMSJunkie - WordPress Business Directory Plugins vulnerabilities

🔔 Create alert RSS

Published CVEs affecting CMSJunkie - WordPress Business Directory Plugins products: 2 record(s), with severity, exploitation and fixes.

WP-BusinessDirectory 2

Exploited only (KEV) →

CVE-2026-39591 Critical · 9.9 CWE-434 Jun 15, 2026

WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

CVE-2025-68887 High · 7.1 CWE-79 Jan 8, 2026

WordPress WP-BusinessDirectory plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through <= 4.0.1.