CVE-2026-104726
MediumCVSS 6.4Summary
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dir' shortcode attribute in all versions up to and including 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in visitors' browsers, enabling session theft, account takeover, or page content modification. The risk affects any WordPress site with this plugin installed.
Recommendation
Update the Name Directory plugin to a version newer than 1.34.2 or disable it if no update is available. Additionally, limit the number of accounts with contributor-level privileges.
Other vulnerabilities in Name Directory
See all- CVE-2026-104397Medium
The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.
- CVE-2026-104396Medium
The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.
Original NVD description (English source)
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS