Cross-site Scripting Vulnerability in Dynamic User Directory by Sarah Giles
CVE-2026-125856

7.1HIGH

Key Information:

Vendor

WordPress
Status
Dynamic User Directory
Vendor
CVE Published:
13 November 2026

What is CVE-2026-125856?

The Dynamic User Directory plugin developed by Sarah Giles contains a vulnerability that allows attackers to exploit reflected Cross-site Scripting (XSS) flaws. This issue enables malicious users to inject scripts into web pages, potentially compromising the integrity and security of user data. Affected versions include those prior to 2.4, which makes it crucial for website administrators to update their installations to safeguard against potential exploitation.

Affected Version(s)

Dynamic User Directory 0 <= 2.4

References

https://patchstack.com/database/wordpress/plugin/dynamic-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scott Lewis | Patchstack Bug Bounty Program
.