Stored Cross-Site Scripting Vulnerability in Name Directory Plugin for WordPress

CVE-2026-3178

What is CVE-2026-3178?

The Name Directory plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the 'name_directory_name' parameter. Due to inadequate input sanitization and output escaping, this weakness enables the injection of arbitrary web scripts into pages. Consequently, when users visit an affected page, the injected scripts execute, posing significant security risks. It's crucial to be aware that while partial patches were applied in versions 1.30.3 and 1.32.1, all versions up to 1.32.1 remain susceptible to this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References