Employee Directory Vulnerabilities

[en] Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress allows Object Injection. This issue affects Employee Directory – Staff Listing & Team Directory Plugin for WordPress: from n/a through 4.5.3.

Affected:

up to 4.5.3

Fix:

No patched version reported

Disclosed:

Aug 28, 2025

CVE-2025-53243 on NVD →

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.5.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is p...

CVSS:

8.1

Affected:

up to 4.5.5

Fixed in:

4.5.6

Disclosed:

Aug 25, 2025

CVE-2025-53243 on NVD →

The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

CVSS:

6.4

Affected:

up to 4.5.1

Fixed in:

4.5.2

Disclosed:

Aug 4, 2025

CVE-2025-8295 on NVD →

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVSS:

6.4

Affected:

up to 4.5.0

Fixed in:

4.5.1

Disclosed:

Jun 3, 2025

CVE-2025-5531 on NVD →

Affected:

up to 4.5.1

Fixed in:

4.5.1

CVE-2025-5531 on NVD →

Affected:

up to 4.5.2

Fixed in:

4.5.2

CVE-2025-8295 on NVD →