# CVE-2026-16591: WP Directory Kit stored cross-site scripting in category and location fields

Source: https://junglewise.ai/threats/cve-2026-16591-the-wp-directory-kit-wordpress-plugin-before-1-5-8-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-16591 · Severity: info · Published 2026-09-26

The WP Directory Kit WordPress plugin fails to properly sanitize category and location field inputs before displaying them on web pages. An attacker with the listing-management role can inject malicious scripts that execute in the browsers of all website visitors viewing affected pages, potentially stealing credentials or compromising site security.

Technologies: [WP Directory Kit](https://junglewise.ai/threats/technologies/wp-directory-kit). Vendors: [WP Directory Kit](https://junglewise.ai/threats/vendors/wp-directory-kit).

## Quick answers

**Is CVE-2026-16591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16591 being exploited in the wild.

**How severe is CVE-2026-16591?** Informational severity, published 26 September 2026.

**Which products and versions are affected?** WP Directory Kit before 1.5.8.

**Is there a fix for CVE-2026-16591?** A patch was published on 2026-09-24: Fixed in version 1.5.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16591 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16591?** Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not sanitize and escape category and location title and icon fields before outputting them in HTML page attributes, enabling stored XSS. Users with the plugin-specific listing-management role (lacking unfiltered_html capability) can inject arbitrary JavaScript that persists in the database and executes for any visitor. The vulnerability is fixed in version 1.5.8.

## Affected products

- WP Directory Kit WP Directory Kit before 1.5.8

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: patched: Fixed in version 1.5.8

## References

- [https://wpscan.com/vulnerability/7b5600f1-1024-4329-97de-6347420e46c1/](https://wpscan.com/vulnerability/7b5600f1-1024-4329-97de-6347420e46c1/)

## Related threats

- [WP Directory Kit SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-118421-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection via main_field parameter](https://junglewise.ai/threats/cve-2026-118420-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit unauthenticated data disclosure](https://junglewise.ai/threats/cve-2026-118418-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection in idfield parameter](https://junglewise.ai/threats/cve-2026-109197-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)
- [WP Directory Kit SQL injection in data_fields_list parameter](https://junglewise.ai/threats/cve-2026-16596-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)