CVE-2023-4757

CVE-2023-4757 is a stored cross-site scripting (XSS) vulnerability affecting the Staff / Employee Business Directory for Active Directory WordPress plugin prior to version 1.2.3. It allows authenticated users with control over their LDAP directory entries to inject malicious JavaScript, potentially impacting high-privilege users like site administrators. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity requiring user interaction and low privileges. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting a low current threat level.