CVE-2026-104726: Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to add content containing the affected dir shortcode attribute.
What happens after a malicious shortcode is added?
The injected script is stored in a page and executes in the browser of users who access that page. The issue can affect confidentiality and integrity in the context of the visiting user’s session.
Which versions should be considered affected?
All Name Directory versions through 1.34.2, inclusive, are affected. The referenced source paths indicate version 1.34.3 contains relevant shortcode code changes.
How can administrators check for possible exploitation?
Review pages and other WordPress content created by Contributor-level or higher users for Name Directory dir shortcodes, especially attribute values containing script-like or HTML payloads. Focus on content added by untrusted or unexpected authenticated accounts.