CVE-2025-62982
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.
Risk Assessment
An attacker can store a malicious script that executes in a user's browser, potentially leading to session theft or content modification.
Recommendation
Update the Dynamic User Directory plugin to a version newer than 2.3 if available, or consider disabling it until a fix is released.
Other vulnerabilities in Dynamic User Directory
See all- CVE-2026-42719Critical
The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
- CVE-2026-42720High
The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS