---
id: "CVE-2026-125856"
page: "https://infrastack.ai/live/CVE-2026-125856"
kind: "vulnerability"
aliases: ["CVE-2026-125856"]
title: "Dynamic User Directory WordPress plugin: reflected XSS through version 2.4"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dynamic-user-directory", "fixed": [], "affected": "<= 2.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dynamic-user-directory", "package", "plugin", "unauthenticated", "wordpress", "xss"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:43+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:49:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125856", "first_seen_at": "2026-11-13T15:46:19+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability", "first_seen_at": "2026-11-13T15:49:55+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability", "https://wordpress.org/plugins/dynamic-user-directory/"]}]
exploit_sources: []
---

# Dynamic User Directory WordPress plugin: reflected XSS through version 2.4

Link for people: https://infrastack.ai/live/CVE-2026-125856 (this .md is for agents)

The Dynamic User Directory plugin for WordPress has a reflected cross-site scripting flaw in versions through 2.4. An attacker can craft a link that runs script in a visitor's browser when they open it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dynamic-user-directory affected <= 2.4 fixed no fixed version listed

## How to check

Run 'wp plugin list --name=dynamic-user-directory --fields=name,version,status', or check Plugins in WP admin. Any version <= 2.4 is affected, and 2.4 is the latest release. Also look for pages with the directory shortcode, since that is where the plugin renders.

## Fix

No patched version as of 2026-11-13: Patchstack lists none, and the newest release on wordpress.org is 2.4. Deactivate and remove the plugin if you can't live without the directory page being public, or restrict the page that holds the directory shortcode.

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125856
- 2026-11-13T15:49:55+00:00 analyst https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability — Patchstack (CNA) says <=2.4 vulnerable, unauthenticated, user interaction needed, no official patch. wordpress.org changelog tops out at 2.4 (Nov 2025), whose fix was for a different CVE-2025-62982. Vulnerable parameter not published. Nothing verified: Patchstack is not the vendor.

## Documents

- [advisory] Patchstack: Dynamic User Directory <= 2.4 XSS https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-cross-site-scripting-xss-vulnerability
- [describes] Dynamic User Directory plugin page and changelog https://wordpress.org/plugins/dynamic-user-directory/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Reflected XSS.This issue affects Dynamic User Directory: from n/a through 2.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_