Name Directory vulnerabilities

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dir' shortcode attribute in all versions up to and including 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page.

The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.

The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.