Stored Cross-Site Scripting Vulnerability in Name Directory Plugin for WordPress
CVE-2026-3178

7.2HIGH

Key Information:

Vendor

WordPress
Status
Name Directory
Vendor
CVE Published:
11 March 2026

What is CVE-2026-3178?

The Name Directory plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the 'name_directory_name' parameter. Due to inadequate input sanitization and output escaping, this weakness enables the injection of arbitrary web scripts into pages. Consequently, when users visit an affected page, the injected scripts execute, posing significant security risks. It's crucial to be aware that while partial patches were applied in versions 1.30.3 and 1.32.1, all versions up to 1.32.1 remain susceptible to this issue.

Affected Version(s)

Name Directory 0 <= 1.32.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/name-directory...
https://plugins.trac.wordpress.org/browser/name-directory...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youssef Elouaer
.