Dynamic User Directory vulnerabilities

The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.

The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.

The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.