CVE-2025-5532 is a stored cross-site scripting vulnerability (CWE-79) in the Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress, affecting all versions up to 1.9.0. The issue stems from improper neutralization of input during web page generation, specifically in the 'emd_mb_meta' shortcode, where user-supplied attributes are not adequately sanitized or escaped. This allows authenticated attackers with contributor-level privileges or higher to inject malicious scripts that persist and execute in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact with no availability impact.

An attacker with contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the compromised pages, potentially leading to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from emarket-design regarding patches or mitigations. Avoid using the 'emd_mb_meta' shortcode with untrusted input.