Live › vulnerability › CVE-2026-104726
Go to dashboardThe Name Directory plugin for WordPress does not sanitize the 'dir' shortcode attribute, so output is not escaped. A contributor-level user can store a script in a page that runs for every visitor who opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Name Directory WordPress plugin version or earlier where contributor-level or higher users can edit content that uses the shortcode. Sites without the plugin, or where only trusted editors can publish, face lower risk.
1.34.2No product ranges from the sources yet.
1.34.2 and earlier.dir attribute of the Name Directory shortcode and inspect it for script tags.1.34.2 once the vendor releases one; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-104726")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.