CVE-2025-5532

Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

View on CVE.org

Published Jun 4, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress contains a stored cross‑site scripting flaw triggered by the 'emd_mb_meta' shortcode attribute. Attackers with contributor‑level permissions can inject arbitrary JavaScript that is saved in the database and executed whenever any user loads a page containing the injected content. This enables session hijacking, defacement and malicious redirects, making the weakness a classic CWE‑79 input validation and output escaping failure.

Affected Systems

Any WordPress site that installs emarket‑design’s Campus Directory – Faculty, Staff & Student Directory Plugin with a version of 1.9.0 or earlier is affected. All such installations are susceptible regardless of site configuration or additional plugins.

Risk and Exploitability

The vulnerability has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, showing a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is authenticated web application access with contributor or higher privileges; after upstream injection, the exploit becomes persistent and impacts all users who view the affected page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

emarket-design

Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.9.0

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the plugin to the latest version that removes the vulnerable shortcode (or any release above 1.9.0).
If an upgrade is not immediately possible, restrict the Contributor role on the site or remove the 'emd_mb_meta' shortcode to prevent further injections.
Deploy a Web Application Firewall rule or server‑side filter to detect and block malicious JavaScript payloads submitted via the shortcode until a patch is applied.
Continuously monitor site logs for unexpected script injections and review user accounts with elevated permissions for suspicious activity.

Generated by OpenCVE AI on April 22, 2026 at 14:53 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-16820	The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.233% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve

History

Jun 4, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2025 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`