Medium severity5.4NVD Advisory· Published Jan 16, 2024· Updated Jun 17, 2026
CVE-2023-4757
CVE-2023-4757
Description
The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:miniorange:staff_\/_employee_business_directory_for_active_directory:*:*:*:*:*:wordpress:*:*Range: <1.2.3
- Range: <1.2.3
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/0b953413-cf41-4de7-ac1f-c6cb995fb158/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.