{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5531", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-03T14:54:11.122Z", "datePublished": "2025-06-04T03:40:58.146Z", "dateUpdated": "2026-04-08T16:36:46.710Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:46.710Z"}, "affected": [{"vendor": "emarket-design", "product": "Employee Directory \u2013 Staff & Team Directory", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Employee Directory \u2013 Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Staff Directory \u2013 Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/143c5f1f-032c-4207-9401-20f18efcad9d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3295945%40employee-directory&new=3295945%40employee-directory&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-30T08:23:06.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-06-03T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-04T13:36:17.351366Z", "id": "CVE-2025-5531", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T13:47:50.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5531", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-04T13:36:17.351366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T13:47:44.857Z"}}], "cna": {"title": "Staff Directory \u2013 Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "emarket-design", "product": "Employee Directory \u2013 Staff & Team Directory", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.5.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-30T08:23:06.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-06-03T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/143c5f1f-032c-4207-9401-20f18efcad9d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3295945%40employee-directory&new=3295945%40employee-directory&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Employee Directory \u2013 Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:46.710Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5531", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:46.710Z", "dateReserved": "2025-06-03T14:54:11.122Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-04T03:40:58.146Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Employee Directory \u2013 Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Employee Directory \u2013 Staff Listing &amp; Team Directory Plugin for WordPress para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'emd_mb_meta' del plugin en todas las versiones hasta la 4.5.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5531", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-04T04:15:54.140", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3295945%40employee-directory&new=3295945%40employee-directory&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/143c5f1f-032c-4207-9401-20f18efcad9d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:53:18.081760+00:00", "value": {"mitigation_remediation": ["Upgrade the Employee Directory \u2013 Staff & Team Directory plugin to the latest version that includes an XSS fix", "If an immediate upgrade is not possible, remove or disable the 'emd_mb_meta' shortcode from affected pages or disable the entire plugin until a fix is available", "Implement or configure a web application firewall or security plugin to sanitize output and block the execution of injected scripts"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "Vendor emarket\u2011design releases the Employee Directory \u2013 Staff & Team Directory plugin for WordPress. All versions up to and including 4.5.0 are vulnerable; newer releases are not affected according to the available data.", "description_and_impact": "The Employee Directory \u2013 Staff & Team Directory WordPress plugin contains a stored XSS flaw in the 'emd_mb_meta' shortcode caused by insufficient input sanitization and output escaping. Authenticated users with contributor access or higher can inject arbitrary scripts that will run whenever any user views a page containing the shortcode. This enables attackers to steal credentials, deface content, or perform other malicious actions in the context of legitimate users.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation, though the vulnerability is listed in a public advisory and not flagged in KEV. The flaw requires authenticated contributor\u2011level or higher access; once the attacker injects content, any user who visits the affected page will have the malicious script executed. The risk remains moderate to high in environments where contributor roles are widely available and content with the shortcode is common."}}}}, "created": "2026-04-22T15:00:05.616816+00:00", "updated": "2026-04-22T15:00:05.616836+00:00", "vendors": []}