Security Alert Summary
The Employee Directory plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the form_title parameter used by the search_employee_directory shortcode. Authenticated users with Contributor-level access and above can inject scripts that will run when other users view the affected pages.
CVE Details
- CVE ID: CVE-2026-1279
- Affected component: Employee Directory plugin for WordPress (as stated in the CVE description)
- Affected versions: All versions up to, and including, 1.2.1
- Published: February 6, 2026 at 8:15:52 AM
- Last modified: February 6, 2026 at 3:14:47 PM
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated user; the CVE description specifies exploitation by users with Contributor-level access and above. Privileges Required: LOW; User Interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This issue is a stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and lack of output escaping for the form_title parameter used by the search_employee_directory shortcode. Because input provided to that parameter is stored and later rendered in pages, an authenticated attacker who can supply a malicious form_title value can inject arbitrary JavaScript that will execute in the browsers of users who view the affected page.
The CVE description specifically identifies the form_title parameter and the search_employee_directory shortcode as the vectors. The root cause is the absence of proper sanitization on input and/or escaping on output when rendering the stored value, which permits stored XSS payloads to persist and execute.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage content, and external contractors or contributors who help maintain pages. A contributor with the ability to edit or add shortcode parameters could insert a malicious form_title value. When administrators, editors, or site visitors load the page containing the injected shortcode, the malicious script could run in their browsers.
- An attacker-controlled script could read information visible to the page (for example, client-side content or form fields), potentially exposing internal user information such as names or email addresses accessible via the page.
- Exposed or harvestable contact information increases the risk of targeted phishing or social engineering against staff or contractors.
- Because the vulnerability is XSS (confidentiality and integrity impacts rated LOW), it does not inherently grant direct server access, but it can be used to perform actions in the context of an authenticated user’s browser or to capture session-related data.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Restrict and review user roles: reduce the number of users with Contributor-level access or higher where possible.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior, especially changes to pages that use the
search_employee_directoryshortcode.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/employee-staff-directory/tags/1.2.1/handler/mo-empdir-search_handler.php#L29
- https://plugins.trac.wordpress.org/browser/employee-staff-directory/trunk/handler/mo-empdir-search_handler.php#L29
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3448620%40employee-staff-directory&new=3448620%40employee-staff-directory
- https://wordpress.org/plugins/employee-staff-directory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d3b54c-6244-4776-be3c-afe3a28a2b8a?source=cve
