The Campus Directory WordPress plugin stores arbitrary JavaScript supplied through the noaccess_msg parameter when an authenticated user has Contributor or higher privileges. The injected code is executed whenever any visitor loads a page containing the value, creating a stored XSS flaw that can reveal sensitive information or alter user experience.

This vulnerability affects the emarket‑design Campus Directory – Faculty, Staff & Student Directory plugin for WordPress, in all releases up to and including version 1.9.1.

With a CVSS score of 6.4, the flaw is considered moderate. The EPSS score of less than 1 % indicates that, so far, exploitation is unlikely, and it is not listed in CISA’s KEV catalog. However, because the attack requires only Contributor‑level access, an attacker who can author or edit content can readily exploit the flaw. Based on the description, it is inferred that an attacker could exploit the stored script to steal credentials, deface content, or redirect users.