CVE-2026-28004

The CVSS 7.1/EPSS gap on this CVE is real but should not drive your prioritization. Here's what actually matters: check your Business Directory version. The 2026 dating in the CVE ID is a significant signal — it suggests either an embargoed disclosure or an anomaly in MITRE's assignment process. Either way, this may describe a historical vulnerability in version 6.4.25 that has since been superseded by 6.5.x or later releases. If you're running a current version, this CVE may already be remediated by routine updates, and the EPSS is correctly pricing in the reality that the exploitable population is shrinking. If you're on an older version, the question shifts from scoring metrics to attack surface geometry. Business Directory loads conditionally — vulnerable endpoints only activate when specific features are enabled (search shortcodes, listing submission forms, premium field modules). "Unauthenticated" in the CVE does not mean "trivially reachable across all installations." It means access is possible in principle, but the practical path requires knowing which parameters to target and which features must be active. The CVSS 7.1 already reflects this limitation — for a truly accessible unauthenticated XSS, you'd typically see 8.0+. The EPSS is reinforcing what the CVSS is already quietly admitting. That said, the blast radius matters more than the exploitability probability. Business Directory handles structured business data and often triggers email notifications to administrators when listings are submitted or updated. A stored XSS in this context can escalate to admin session theft through notification emails or admin-facing dashboards — not through the front-end alone. Even if mass automation is unlikely (the low EPSS), a targeted attacker who identifies a vulnerable installation has meaningful post-exploitation access. Prioritize this if: you run Business Directory versions below the current stable release AND you have public-facing directory submission or search features enabled. Deprioritize if you're current and don't use premium field modules. The EPSS is not underweighting a genuine risk — it's correctly priced for a narrow, conditional attack surface in a plugin ecosystem where "unauthenticated" has different meaning than in traditional software.

Reviewed through automated stages and approved by a human before publication.