The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress contains a stored cross‑site scripting flaw triggered by the 'emd_mb_meta' shortcode attribute. Attackers with contributor‑level permissions can inject arbitrary JavaScript that is saved in the database and executed whenever any user loads a page containing the injected content. This enables session hijacking, defacement and malicious redirects, making the weakness a classic CWE‑79 input validation and output escaping failure.

Any WordPress site that installs emarket‑design’s Campus Directory – Faculty, Staff & Student Directory Plugin with a version of 1.9.0 or earlier is affected. All such installations are susceptible regardless of site configuration or additional plugins.

The vulnerability has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, showing a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is authenticated web application access with contributor or higher privileges; after upstream injection, the exploit becomes persistent and impacts all users who view the affected page.