---
id: "CVE-2026-104726"
kind: "vulnerability"
aliases: ["CVE-2026-104726"]
title: "Name Directory WordPress plugin: stored XSS via shortcode attribute"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-not-installed", "trusted-editors-only"]
published_at: "2026-10-16T09:17:03+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:59:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104726", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Name Directory WordPress plugin: stored XSS via shortcode attribute

The Name Directory plugin for WordPress does not sanitize the 'dir' shortcode attribute, so output is not escaped. A contributor-level user can store a script in a page that runs for every visitor who opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Name Directory plugin is installed and its version in the WordPress admin under Plugins; affected versions are `1.34.2` and earlier.
- Search post and page content for the `dir` attribute of the Name Directory shortcode and inspect it for script tags.

## Fix

- Update the Name Directory plugin to a version later than `1.34.2` once the vendor releases one; the sources do not name the fixed version.
- Until patched, restrict contributor-level accounts and review pages that use the shortcode.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104726

## From the sources

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_