{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5532", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-03T14:57:17.755Z", "datePublished": "2025-06-04T03:40:58.751Z", "dateUpdated": "2026-04-08T16:41:13.062Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:13.062Z"}, "affected": [{"vendor": "emarket-design", "product": "Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Faculty Staff and Student Directory Plugin \u2013 Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-30T08:23:05.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-06-03T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-04T13:36:09.390703Z", "id": "CVE-2025-5532", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T13:47:29.398Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5532", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-04T13:36:09.390703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T13:47:23.453Z"}}], "cna": {"title": "Faculty Staff and Student Directory Plugin \u2013 Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "muhammad yudha"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "emarket-design", "product": "Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.9.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-03T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-06-04T03:40:58.751Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5532", "state": "PUBLISHED", "dateUpdated": "2025-06-04T13:47:29.398Z", "dateReserved": "2025-06-03T14:57:17.755Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-04T03:40:58.751Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Campus Directory \u2013 Faculty, Staff &amp; Student Directory Plugin for WordPress para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'emd_mb_meta' del complemento en todas las versiones hasta la 1.9.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5532", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-04T04:15:59.263", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:53:04.714802+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest version that removes the vulnerable shortcode (or any release above 1.9.0).", "If an upgrade is not immediately possible, restrict the Contributor role on the site or remove the 'emd_mb_meta' shortcode to prevent further injections.", "Deploy a Web Application Firewall rule or server\u2011side filter to detect and block malicious JavaScript payloads submitted via the shortcode until a patch is applied.", "Continuously monitor site logs for unexpected script injections and review user accounts with elevated permissions for suspicious activity."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting from authenticated contributor access"}, "threat_synthesis": {"affected_systems": "Any WordPress site that installs emarket\u2011design\u2019s Campus Directory \u2013 Faculty, Staff & Student Directory Plugin with a version of 1.9.0 or earlier is affected. All such installations are susceptible regardless of site configuration or additional plugins.", "description_and_impact": "The Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress contains a stored cross\u2011site scripting flaw triggered by the 'emd_mb_meta' shortcode attribute. Attackers with contributor\u2011level permissions can inject arbitrary JavaScript that is saved in the database and executed whenever any user loads a page containing the injected content. This enables session hijacking, defacement and malicious redirects, making the weakness a classic CWE\u201179 input validation and output escaping failure.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, showing a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is authenticated web application access with contributor or higher privileges; after upstream injection, the exploit becomes persistent and impacts all users who view the affected page."}}}}, "created": "2026-04-22T15:00:05.612503+00:00", "updated": "2026-04-22T15:00:05.612520+00:00", "vendors": []}