The Employee Directory plugin for WordPress contains a flaw that allows authenticated users with Contributor permissions or higher to store malicious JavaScript in the 'form_title' attribute of the search_employee_directory shortcode. Because the input is not sanitized or escaped when rendered, the stored payload will execute in the browsers of any visitor who views a page containing the malicious content. The vulnerability is classified as a stored cross‑site scripting (CWE‑79) that permits arbitrary client‑side code execution.

The issue affects every release of the plugin up to version 1.2.1. Any WordPress site that has the Cyberlord92 Employee Directory – Staff Directory and Listing plugin installed in a version through 1.2.1 and that uses the search_employee_directory shortcode is susceptible. Sites without the shortcode or those that have already upgraded are not affected.

The CVSS base score for this issue is 6.4, indicating a medium severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of public exploitation at this time. The vulnerability is not recorded in the CISA Known Exploited Vulnerabilities catalog. Exploitability requires a user account with Contributor level or higher, meaning the attacker must first gain authenticated access. Once a payload is stored, it will run automatically for any visitor to the affected page, creating a broad impact on site visitors. Because the attack is not remote but requires authenticated access and the exploitation probability is low, the risk is moderate but still significant for sites that rely on the plugin.