Stored Cross-Site Scripting Found in Employee Directory Plugin by WordPress
CVE-2025-8295

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Employee Directory – Staff Listing & Team Directory Plugin For WordPress
Vendor
CVE Published:
5 August 2025

What is CVE-2025-8295?

The Employee Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerabilities. This flaw exists due to inadequate input sanitization and output escaping in the 'noaccess_msg' parameter. Authenticated attackers with Contributor-level access can exploit this vulnerability to inject malicious scripts. These scripts execute when users access compromised pages, posing a serious risk to site integrity and user security. It is crucial for site administrators to assess their use of the Employee Directory plugin and implement necessary updates or mitigations.

Affected Version(s)

Employee Directory – Staff Listing & Team Directory Plugin for WordPress * <= 4.5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/employee-directory/#developers
https://plugins.trac.wordpress.org/browser/employee-direc...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha
JSON
.
CVE-2025-8295 : Stored Cross-Site Scripting Found in Employee Directory Plugin by WordPress