Stored Cross-Site Scripting Found in Employee Directory Plugin by WordPress

CVE-2025-8295

What is CVE-2025-8295?

The Employee Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerabilities. This flaw exists due to inadequate input sanitization and output escaping in the 'noaccess_msg' parameter. Authenticated attackers with Contributor-level access can exploit this vulnerability to inject malicious scripts. These scripts execute when users access compromised pages, posing a serious risk to site integrity and user security. It is crucial for site administrators to assess their use of the Employee Directory plugin and implement necessary updates or mitigations.

References