Employee Directory – Staff & Team Directory Security & Risk Analysis

The 'employee-directory' plugin version 4.5.5 exhibits a mixed security posture. While many security best practices are followed, including the use of prepared statements for all SQL queries and a high percentage of output escaping, several significant concerns exist. The presence of 9 AJAX handlers without authentication checks represents a considerable attack surface, potentially allowing unauthorized actions. The taint analysis reveals 2 high-severity flows with unsanitized paths, indicating potential vulnerabilities that could lead to data leakage or execution of unintended code.

The plugin's vulnerability history is also a point of concern, with 3 known CVEs, one of which remains unpatched and is classified as high severity. The common vulnerability types, such as Deserialization of Untrusted Data and Cross-site Scripting, combined with the recent discovery of a vulnerability (2025-08-25), suggest a pattern of exploitable weaknesses. While the use of nonces and capability checks on most AJAX handlers is positive, the unprotected entry points and the ongoing unpatched vulnerability significantly detract from its overall security. This plugin requires careful review and immediate attention to address the unpatched CVE and the identified unsanitized data flows.