WordPress Directory Kit Plugin Stored XSS via Unescaped Fields

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-16591 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Directory Kit WordPress plugin before version 1.5.8. The plugin fails to properly sanitize and escape category and location fields before displaying them in page attributes, enabling authenticated users with listing-management roles to inject malicious scripts. These scripts persist in the database and execute for all visitors viewing affected pages, compromising site integrity and exposing visitors to credential theft, malware distribution, and session hijacking. This vulnerability is particularly dangerous because it requires only limited administrative privileges and affects any WordPress installation using the vulnerable plugin versions.

Casky's 323 matching security skills leverage Claude's extended reasoning to map this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using the platform would observe detection patterns identifying CWE-79 violations through analysis of unescaped output contexts, suspicious JavaScript injection attempts in form field submissions, and persistence mechanisms in database queries. The system would flag stored payload execution chains—showing how injected scripts propagate through page rendering—and correlate them with user roles lacking proper input validation controls. Practitioners would see findings highlighting the gap between authentication boundaries and sanitization enforcement, allowing them to prioritize remediation of plugin updates and implement output encoding controls before malicious payloads reach end users.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16591.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16591

Casky has 323 skills that investigate the attack patterns behind CVE-2026-16591. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn