{"id":"CVE-2026-104726","kind":"vulnerability","aliases":["CVE-2026-104726"],"related":[],"title":"Name Directory WordPress plugin: stored XSS via shortcode attribute","description":"The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Name Directory plugin for WordPress does not sanitize the 'dir' shortcode attribute, so output is not escaped. A contributor-level user can store a script in a page that runs for every visitor who opens it.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","trusted-editors-only"],"how_to_check":"- Check whether the Name Directory plugin is installed and its version in the WordPress admin under Plugins; affected versions are `1.34.2` and earlier.\n- Search post and page content for the `dir` attribute of the Name Directory shortcode and inspect it for script tags.","fix":"- Update the Name Directory plugin to a version later than `1.34.2` once the vendor releases one; the sources do not name the fixed version.\n- Until patched, restrict contributor-level accounts and review pages that use the shortcode.","status":"open","published_at":"2026-10-16T09:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:41+00:00","updated_at":"2026-10-25T03:59:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Name Directory plugin to a version later than `1.34.2` once the vendor releases one; the sources do not name the fixed version.\n- Until patched, restrict contributor-level accounts and review pages that use the shortcode.","reach":"internet","title":"Name Directory WordPress plugin: stored XSS via shortcode attribute","impact":"medium","summary":"The Name Directory plugin for WordPress does not sanitize the 'dir' shortcode attribute, so output is not escaped. A contributor-level user can store a script in a page that runs for every visitor who opens it.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions.","analyst_note":"Confirm the fixed version and the vendor advisory at the NVD link; the sources do not name a patched release.","how_to_check":"- Check whether the Name Directory plugin is installed and its version in the WordPress admin under Plugins; affected versions are `1.34.2` and earlier.\n- Search post and page content for the `dir` attribute of the Name Directory shortcode and inspect it for script tags.","needs_analyst":true,"not_affected_if":["plugin-not-installed","trusted-editors-only"],"who_is_affected":"Sites running the Name Directory WordPress plugin version `1.34.2` or earlier where contributor-level or higher users can edit content that uses the shortcode. Sites without the plugin, or where only trusted editors can publish, face lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3370,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104726':12A,15A '-2026':11A,14A '1.34.2':86C 'access':106C,122C 'arbitrari':111C 'attack':101C 'attribut':9A,36B,78C 'authent':100C 'contributor':44B,104C 'contributor-level':43B,103C 'cross':72C 'cross-sit':71C 'cve':10A,13A 'dir':34B,76C 'directori':2A,26B,63C 'due':87C 'escap':41B,94C 'everi':57B 'execut':118C 'host':19B 'includ':85C 'inject':110C,124C 'input':90C 'insuffici':89C 'level':45B,105C 'make':96C 'name':1A,25B,62C 'open':60B 'output':38B,93C 'packag':16B 'page':53B,115C,125C 'plugin':4A,23B,27B,64C 'possibl':98C 'run':55B 'sanit':32B,91C 'script':50B,74C,113C 'self':18B 'self-host':17B 'shortcod':8A,35B,77C 'site':73C 'store':5A,48B,70C 'user':46B,121C 'version':81C 'via':7A,75C 'visitor':58B 'vulner':68C 'web':112C 'whenev':119C 'wordpress':3A,20B,22B,29B,66C 'wordpress-plugin':21B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Name Directory WordPress plugin version `1.34.2` or earlier where contributor-level or higher users can edit content that uses the shortcode. Sites without the plugin, or where only trusted editors can publish, face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T09:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104726","severity":null,"published_at":"2026-10-16T09:17:03+00:00","modified_at":"2026-10-16T15:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}