CVE-2026-104396
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.
Risk Assessment
An attacker can inject malicious scripts that execute in the browser of administrators or other users, potentially leading to session theft, account takeover, or malware propagation.
Recommendation
Update the Name Directory plugin to the latest version with a fix. Additionally, consider implementing input and output filtering mechanisms (e.g., Content Security Policy).
Other vulnerabilities in Name Directory
See all- CVE-2026-104726Medium
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dir' shortcode attribute in all versions up to and including 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page.
- CVE-2026-104397Medium
The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS