Junglewise Threat Intelligence

CVE-2026-8892: CreativeMinds CM Business Directory stored XSS in address meta fields

CVE-2026-8892 · Severity: medium · CVSS 6.4 · Published 2026-07-03

Executive brief

The CM Business Directory plugin for WordPress, which is used to create and manage local business listings, contains a security flaw in how it handles business address information. An attacker with a basic contributor account can inject malicious scripts into address fields like city, state, or postal code. These scripts will then execute in the browser of any visitor who views that business listing, potentially leading to unauthorized actions or data theft.

Technical details

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the Business Address Meta Fields of the CM Business Directory plugin. The root cause is the lack of proper sanitization and output escaping for post meta fields such as cmbd_address, cmbd_cityTown, cmbd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country. Because these payloads are stored in post meta rather than post_content, the standard WordPress 'unfiltered_html' capability check is bypassed. An authenticated attacker with at least contributor-level permissions can inject malicious HTML or JavaScript, which will execute in the context of any user viewing the business directory page. The issue is present in all versions up to and including 1.5.7.

Affected products

  • CreativeMinds Solutions CM Business Directory – Optimise and showcase local business up to, and including, 1.5.7

Timeline

  • 2026-07-03: advisory: NVD publication date

References