Threat Database

Threat Entry Updated 2026-07-01

Wp Businessdirectory - Path Traversal (CVE-2026-6070)

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes directory separator characters without stripping path traversal sequences (../). When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an…

PLUGIN Wp Businessdirectory

CVE-2026-6070

CRITICAL CVSS 9.1 2026-07-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WP-BusinessDirectory - Arbitrary File Upload (CVE-2026-39591)

Subscriber Arbitrary File Upload in WP-BusinessDirectory

PLUGIN WP-BusinessDirectory

CVE-2026-39591

CRITICAL CVSS 9.9 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WP-BusinessDirectory - Cross-Site Scripting (XSS) (CVE-2025-68887)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through

PLUGIN WP-BusinessDirectory

CVE-2025-68887

HIGH CVSS 7.1 2026-01-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WP-BusinessDirectory - SQL Injection (CVE-2025-24759)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through

PLUGIN WP-BusinessDirectory

CVE-2025-24759

CRITICAL CVSS 9.3 2025-07-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Wp Businessdirectory - Cross-Site Scripting (XSS) (CVE-2025-32630)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through

PLUGIN Wp Businessdirectory

CVE-2025-32630

HIGH CVSS 7.1 2025-04-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WP-BusinessDirectory - Path Traversal (CVE-2025-32629)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Path Traversal.This issue affects WP-BusinessDirectory: from n/a through

PLUGIN WP-BusinessDirectory

CVE-2025-32629

HIGH CVSS 8.6 2025-04-11

Risk Score

Open Full Technical Breakdown