Technical impact
An improper neutralization of input during web page generation allows stored cross‑site scripting. The flaw permits an attacker to persist malicious scripts within the Dynamic User Directory plugin’s data store, which are later rendered in users’ browsers without proper sanitization. This can lead to session hijacking, credential theft, defacement, or the delivery of further malware to victims.
Affected Systems
The vulnerability affects the WordPress Dynamic User Directory plugin by Sarah Giles. All releases from the earliest version up to and including 2.4 are impacted. Users running the plugin on any WordPress installation are therefore exposed.
Risk and Exploitability
The CVSS score of 6.5 classifies this as a moderate‑severity vulnerability. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is via any input field that stores directory information; an attacker who can inject script a payload stored in the directory will cause victims viewing that data to execute the script. No additional prerequisites are noted, but the vulnerability can be exploited as long as the affected plugin is active on a publicly accessible site.
