{"id":"CVE-2026-125856","kind":"vulnerability","aliases":["CVE-2026-125856"],"related":[],"title":"Dynamic User Directory WordPress plugin: reflected XSS through version 2.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Reflected XSS.This issue affects Dynamic User Directory: from n/a through 2.4.","summary":"The Dynamic User Directory plugin for WordPress has a reflected cross-site scripting flaw in versions through 2.4. An attacker can craft a link that runs script in a visitor's browser when they open it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dynamic-user-directory","fixed":[],"affected":"<= 2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-user-directory","package","plugin","unauthenticated","wordpress","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list --name=dynamic-user-directory --fields=name,version,status', or check Plugins in WP admin. Any version <= 2.4 is affected, and 2.4 is the latest release. Also look for pages with the directory shortcode, since that is where the plugin renders.","fix":"No patched version as of 2026-11-13: Patchstack lists none, and the newest release on wordpress.org is 2.4. Deactivate and remove the plugin if you can't live without the directory page being public, or restrict the page that holds the directory shortcode.","status":"open","published_at":"2026-11-13T15:17:43+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:30+00:00","updated_at":"2026-11-13T15:49:55+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-13T15:48:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dynamic User Directory WordPress plugin: reflected XSS through version 2.4","impact":"medium","summary":"The Dynamic User Directory plugin for WordPress has a reflected cross-site scripting flaw in versions through 2.4. An attacker can craft a link that runs script in a visitor's browser when they open it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","dynamic-user-directory"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in a logged-in user's browser session","analyst_note":"Find the fixed version and the vulnerable parameter from the NVD entry or the plugin's changelog on wordpress.org.","how_to_check":"- Check whether the `dynamic-user-directory` plugin is installed and its version in the WordPress admin plugin list\n- Compare the installed version against `2.4`; versions through 2.4 are listed as affected","plain_action":"","product_name":"dynamic-user-directory","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Dynamic User Directory plugin for WordPress at version 2.4 or earlier are affected. The sources do not name a fixed version or say which pages or settings are exposed. Sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":4557,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable parameter from the NVD entry or the plugin's changelog on wordpress.org.","search":"'-125856':13A,16A '-2026':12A,15A '2.4':10A,48B,100C 'affect':93C 'allow':89C 'attack':50B 'browser':62B 'craft':52B 'cross':41B,75C 'cross-sit':40B,74C 'cve':11A,14A 'directori':3A,24B,33B,84C,88C,96C 'directory':20A 'dynam':1A,22B,31B,82C,86C,94C 'dynamic':18A 'dynamic-user-directori':21B,85C 'dynamic-user-directory':17A 'flaw':44B 'generat':73C 'gile':81C 'improp':66C 'input':69C 'issu':92C 'link':54B 'n/a':98C 'neutral':67C 'open':65B 'packag':25B 'page':72C 'plugin':5A,26B,34B 'reflect':6A,39B,90C 'run':56B 'sarah':80C 'script':43B,57B,77C 'site':42B,76C 'unauthent':27B 'user':2A,19A,23B,32B,83C,87C,95C 'version':9A,46B 'visitor':60B 'vulner':78C 'web':71C 'wordpress':4A,28B,36B 'xss':7A,29B 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Dynamic User Directory plugin at version 2.4 or earlier, which is every released version. An unauthenticated attacker can craft a link that runs script in a visitor's browser when opened; the vulnerable parameter is not published. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dynamicuserdirectory"],"ptokens":["directory","dynamic","user"],"labels":["dynamicuserdirectory","high","package","plugin","unauthenticated","vendor","wordpress","xss"],"campaign_type":null,"search_a":"'-125856':13A,16A '-2026':12A,15A '2.4':10A 'cve':11A,14A 'directori':3A 'directory':20A 'dynam':1A 'dynamic':18A 'dynamic-user-directory':17A 'plugin':5A 'reflect':6A 'user':2A,19A 'version':9A 'wordpress':4A 'xss':7A","search_b":"'2.4':48B 'attack':50B 'browser':62B 'craft':52B 'cross':41B 'cross-sit':40B 'directori':24B,33B 'dynam':22B,31B 'dynamic-user-directori':21B 'flaw':44B 'link':54B 'open':65B 'packag':25B 'plugin':26B,34B 'reflect':39B 'run':56B 'script':43B,57B 'site':42B 'unauthent':27B 'user':23B,32B 'version':46B 'visitor':60B 'wordpress':28B,36B 'xss':29B","search_c":"'2.4':100C 'affect':93C 'allow':89C 'cross':75C 'cross-sit':74C 'directori':84C,88C,96C 'dynam':82C,86C,94C 'dynamic-user-directori':85C 'generat':73C 'gile':81C 'improp':66C 'input':69C 'issu':92C 'n/a':98C 'neutral':67C 'page':72C 'reflect':90C 'sarah':80C 'script':77C 'site':76C 'user':83C,87C,95C 'vulner':78C 'web':71C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125856","severity":null,"published_at":"2026-11-13T15:17:43+00:00","modified_at":"2026-11-13T15:17:43+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125856:3893","url":"https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability","severity":null,"published_at":"2026-11-13T15:49:55+00:00","modified_at":"2026-11-13T15:49:55+00:00","first_seen_at":"2026-11-13T15:49:55+00:00","fetched_at":"2026-11-13T15:49:55+00:00","note":"Patchstack (CNA) says <=2.4 vulnerable, unauthenticated, user interaction needed, no official patch. wordpress.org changelog tops out at 2.4 (Nov 2025), whose fix was for a different CVE-2025-62982. Vulnerable parameter not published. Nothing verified: Patchstack is not the vendor.","cites":["https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability","https://wordpress.org/plugins/dynamic-user-directory/"]}],"documents":[{"id":147277,"url":"https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability","title":"Patchstack: Dynamic User Directory <= 2.4 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":147278,"url":"https://wordpress.org/plugins/dynamic-user-directory/","title":"Dynamic User Directory plugin page and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}