Stored Cross-Site Scripting Vulnerability in Campus Directory Plugin for WordPress
CVE-2025-5532
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 June 2025
What is CVE-2025-5532?
The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping for the 'emd_mb_meta' shortcode. This vulnerability allows authenticated users with contributor-level access and higher to inject arbitrary scripts into web pages. Consequently, when a user accesses any affected page, the injected script executes, potentially compromising the site's security and user data.
Affected Version(s)
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress * <= 1.9.0