The plugin contains a stored XSS flaw that allows user input to be stored and later rendered without proper escaping. An attacker who can insert malicious code into the plugin’s fields can cause browsers that view the compromised content to execute the attacker’s script. This could enable data theft, session hijacking, or defacement of the site.

The vulnerability affects the "Staff Directory Plugin: Company Directory" by the vendor richardgabriel. All versions from the earliest release up to and including version 4.3 are vulnerable; applying any version newer than 4.3 removes the flaw.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score of less than 1 % suggests a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. Attackers could exploit the flaw by injecting malicious payloads when adding or editing directory entries, which are then displayed to all site visitors or administrators. The impact hinges on the privilege level of the actor who inserts the payload; if they can edit content, they can affect all users who view the page.