{"id":"CVE-2026-125857","kind":"vulnerability","aliases":["CVE-2026-125857"],"related":[],"title":"WordPress Dynamic User Directory plugin: stored XSS through version 2.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through 2.4.","summary":"The Dynamic User Directory WordPress plugin by Sarah Giles has a stored cross-site scripting flaw in versions through 2.4. An attacker who can place input the plugin saves can run script in the browser of anyone who views that page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dynamic-user-directory","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-user-directory","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/dynamic-user-directory/`.\n- Confirm whether the directory pages are published on the site.","fix":null,"status":"open","published_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:40+00:00","updated_at":"2026-11-15T14:37:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T14:37:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Dynamic User Directory plugin: stored XSS through version 2.4","impact":"medium","summary":"The Dynamic User Directory WordPress plugin by Sarah Giles has a stored cross-site scripting flaw in versions through 2.4. An attacker who can place input the plugin saves can run script in the browser of anyone who views that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","dynamic-user-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers, session cookies may be stolen","analyst_note":"Find the fixed version and the vulnerable input in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125857 or the WordPress plugin changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/dynamic-user-directory/`.\n- Confirm whether the directory pages are published on the site.","plain_action":"","product_name":"dynamic-user-directory","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Dynamic User Directory plugin at version 2.4 or earlier. The sources do not name a fixed version or say which inputs are stored unsafely, so the exact exposure is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4557,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125857':13A,16A '-2026':12A,15A '2.4':10A,47B,103C 'affect':96C 'allow':92C 'anyon':64B 'attack':49B 'browser':62B 'cross':40B,78C 'cross-sit':39B,77C 'cve':11A,14A 'directori':4A,24B,30B,87C,91C,99C 'directory':20A 'dynam':2A,22B,28B,85C,89C,97C 'dynamic':18A 'dynamic-user-directori':21B,88C 'dynamic-user-directory':17A 'flaw':43B 'generat':76C 'gile':35B,84C 'improp':69C 'input':53B,72C 'issu':95C 'n/a':101C 'neutral':70C 'packag':25B 'page':68B,75C 'place':52B 'plugin':5A,32B,55B 'run':58B 'sarah':34B,83C 'save':56B 'script':42B,59B,80C 'site':41B,79C 'store':6A,38B,93C 'user':3A,19A,23B,29B,86C,90C,98C 'version':9A,45B 'view':66B 'vulner':81C 'web':74C 'wordpress':1A,26B,31B 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Dynamic User Directory plugin at version 2.4 or earlier. The sources do not name a fixed version or say which inputs are stored unsafely, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dynamicuserdirectory"],"ptokens":["directory","dynamic","user"],"labels":["dynamicuserdirectory","medium","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-125857':13A,16A '-2026':12A,15A '2.4':10A 'cve':11A,14A 'directori':4A 'directory':20A 'dynam':2A 'dynamic':18A 'dynamic-user-directory':17A 'plugin':5A 'store':6A 'user':3A,19A 'version':9A 'wordpress':1A 'xss':7A","search_b":"'2.4':47B 'anyon':64B 'attack':49B 'browser':62B 'cross':40B 'cross-sit':39B 'directori':24B,30B 'dynam':22B,28B 'dynamic-user-directori':21B 'flaw':43B 'gile':35B 'input':53B 'packag':25B 'page':68B 'place':52B 'plugin':32B,55B 'run':58B 'sarah':34B 'save':56B 'script':42B,59B 'site':41B 'store':38B 'user':23B,29B 'version':45B 'view':66B 'wordpress':26B,31B","search_c":"'2.4':103C 'affect':96C 'allow':92C 'cross':78C 'cross-sit':77C 'directori':87C,91C,99C 'dynam':85C,89C,97C 'dynamic-user-directori':88C 'generat':76C 'gile':84C 'improp':69C 'input':72C 'issu':95C 'n/a':101C 'neutral':70C 'page':75C 'sarah':83C 'script':80C 'site':79C 'store':93C 'user':86C,90C,98C 'vulner':81C 'web':74C 'xss.this':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125857","severity":null,"published_at":"2026-11-15T14:17:26+00:00","modified_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}