WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Employee Directory – Staff Listing & Team Directory Plugin for WordPress versions = 4.5.5...

WordPress Employee Directory plugin cross-site scripting vulnerability

WordPress Employee Directory plugin is specially designed for WordPress websites to create and manage employee profile directories. The WordPress Employee Directory plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping ...

CVE-2025-8295

The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-8295 Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

WordPress plugin Employee Directory 跨站脚本漏洞

WordPress Employee Directory plugin is specially designed for WordPress websites to create and manage employee profile directories. The WordPress Employee Directory plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping ...

PT-2025-31915 · WordPress · Employee Directory

Name of the Vulnerable Software and Affected Versions: Employee Directory plugin for WordPress versions up to and including 4.5.1 Description: The Employee Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting through the noaccess msg parameter due to insufficient input...

CVE-2025-5531

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user...

CVE-2025-5531 Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user...

WordPress plugin Employee Directory 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Staff / Employee Business Directory for Active Directory Plugin <= 1.2.3 is vulnerable to Broken Access Control

Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4505 Patch priority Low CVSS severity Low 2.2 Developer Claim ownership PSID 98e206a92bda...

Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries

Description The plugin does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. Add a...

SAP Contact Center Cross-Site Scripting Vulnerability (CNVD-2023-00365)

SAP Contact Center, a new cloud service from SAP, is a modern contact center solution built on top of SAP's on-premise contact center software that puts agents at their fingertips. The vulnerability stems from a program that does not properly encode input. An attacker could exploit the...

CVE-2021-33673

Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting XSS vulnerability when a user browses through the employee directory and to execute arbitrary code ...

CVE-2021-33673

Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting XSS vulnerability when a user browses through the employee directory and to execute arbitrary code ...

ncagr.gov XSS vulnerability

Vulnerable URL: http://www.ncagr.gov/aspzine/employeedirectory/dirsearch.asp?firstname=Justin=query%22%3E%3Cscript/src=%22http://xssposed.org/1.js%3Elol%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:07 GMT Vulnerability type:|...