VulnSocial

CVE-2026-16591

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-16: 110-16
Full discourse1 post
  • DFIR Lab@DFIR_Lab

    🚨 HIGH: CVE-2026-16591 (CVSS 7.2) - WP Directory Kit plugin <1.5.8 vulnerable to Stored XSS. Authenticated attackers can inject malicious scripts via unsanitized category/location fields. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/GLmyjsz9ah

    0001025
    150 followersView on X

Explore more

Back to dashboard