The Campus Directory plugin for WordPress has a security issue that can allow malicious code to be injected into web pages. This vulnerability is present in all versions up to 1.9.1 because the plugin does not properly clean or escape input. This means that attackers who have Contributor-level access or higher can insert harmful scripts into pages, which will run whenever a user visits that page.