Stored Cross-Site Scripting Vulnerability in Employee Directory Plugin for WordPress

CVE-2025-5531

What is CVE-2025-5531?

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping within the plugin's 'emd_mb_meta' shortcode. This vulnerability allows authenticated attackers, with contributor-level access and higher, to inject arbitrary scripts into pages, which will execute whenever a user accesses the compromised page. This presents a significant security risk as it can lead to unauthorized information disclosure or interactions on the affected site.

References