The Employee Directory – Staff & Team Directory WordPress plugin contains a stored XSS flaw in the 'emd_mb_meta' shortcode caused by insufficient input sanitization and output escaping. Authenticated users with contributor access or higher can inject arbitrary scripts that will run whenever any user views a page containing the shortcode. This enables attackers to steal credentials, deface content, or perform other malicious actions in the context of legitimate users.

Vendor emarket‑design releases the Employee Directory – Staff & Team Directory plugin for WordPress. All versions up to and including 4.5.0 are vulnerable; newer releases are not affected according to the available data.

The CVSS score of 6.4 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation, though the vulnerability is listed in a public advisory and not flagged in KEV. The flaw requires authenticated contributor‑level or higher access; once the attacker injects content, any user who visits the affected page will have the malicious script executed. The risk remains moderate to high in environments where contributor roles are widely available and content with the shortcode is common.