Directory Pro, a WordPress plugin from e‑plugins, contains an improper neutralization of user‑controlled input that allows a DOM‑based cross‑site scripting vulnerability. An attacker can embed malicious script payloads that execute in a victim’s browser when the user interacts with a crafted page or plugin interface, potentially enabling cookie theft, session hijacking, or defacement of site content. This flaw falls under CWE‑79 and directly compromises the confidentiality and integrity of user data exposed through the affected plugin.

The vulnerability affects all installations of the Directory Pro plugin up to and including version 2.5.5. No other vendors or product families are listed as impacted.

With a CVSS score of 6.5 the flaw is considered moderate, and the EPSS score of less than 1 % indicates a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker crafting a malicious URL or input that is then rendered by the browser in the context of the vulnerable plugin; successful exploitation requires an unsuspecting victim to visit or interact with the manipulated page.