The Employee Directory plugin for WordPress is vulnerable to stored cross‑site scripting through an insufficiently sanitized and escaped ‘noaccess_msg’ parameter. This flaw permits authenticated users with Contributor level or higher to inject arbitrary JavaScript that will run whenever a page containing the injected message is accessed, potentially compromising the confidentiality, integrity, or availability of user sessions and information. The weakness is classified as CWE‑79.

The vulnerability affects the Employee Directory – Staff & Team Directory plugin from emarket‑design, in all releases up to and including version 4.5.1. No precise sub‑version patch level is specified; upgrading beyond 4.5.1 is required to eliminate the issue.

With a CVSS score of 6.4 and an EPSS score of less than 1 %, the risk of exploitation is moderate to low, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw requires authenticated access, an attacker would need to obtain or abuse Contributor‑level credentials to inject malicious code. Once injected, the script runs on any user who views the affected page, thereby providing an authenticated XSS vector that can be leveraged for session hijacking, credential theft, or defacement.