CVE-2026-104397
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.
Risk Assessment
An unauthorized user may gain access to administrative functions or data they should not have access to, potentially leading to data integrity issues or unauthorized changes.
Recommendation
Update the Name Directory plugin to the latest available version that includes a fix for this vulnerability. Also review the access control configuration in WordPress.
Other vulnerabilities in Name Directory
See all- CVE-2026-104726Medium
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dir' shortcode attribute in all versions up to and including 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page.
- CVE-2026-104396Medium
The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.
Original NVD description (English source)
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS