Vulnerabilities and security researches forname-directory name-directory

Direction: descending

Oct 17, 2026

Name Directory # CVE-2026-104726

CVE, Research URL: CVE-2026-104726
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Oct 16, 2026
Research Description: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.34.3.
Status: vulnerable

Oct 07, 2026

Name Directory # CVE-2026-104396

CVE, Research URL: CVE-2026-104396
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Oct 05, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.
Affected versions: max 1.34.3.
Status: vulnerable

Name Directory # CVE-2026-104397

CVE, Research URL: CVE-2026-104397
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Oct 05, 2026
Research Description: Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
Affected versions: max 1.34.3.
Status: vulnerable

Jun 15, 2026

Name Directory # d9da37b2c5b7e1d34aae68e68081cd9de47d1940

CVE, Research URL: d9da37b2c5b7e1d34aae68e68081cd9de47d1940
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jul 15, 2022
Research Description: Name Directory [name-directory] < 1.25.5 Name Directory <= 1.25.4 - Unauthorized Settings Update The Name Directory plugin for WordPress is vulnerable to unauthorized settings update due to insufficient permissions checking on the name_directory_options() function in versions up to, and including, 1.25.4. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to perform. a variety of actions such as importing, editing, and managing directories that can also be used to inject malicious JavaScript into web pages.
Affected versions: max 1.25.5.
Status: vulnerable

Name Directory # fe7b3a223e327203ce3497558451329d4203ef94

CVE, Research URL: fe7b3a223e327203ce3497558451329d4203ef94
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jun 28, 2022
Research Description: Name Directory [name-directory] < 1.25.4 WordPress Name Directory plugin <= 1.25.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered in the WordPress Name Directory plugin (versions <= 1.25.3). Update the WordPress Name Directory plugin to the latest available version (at least 1.25.4).
Affected versions: max 1.25.4.
Status: vulnerable

Name Directory # 7340dfae9bbdf2db306fce669fe8e0f987696749

CVE, Research URL: 7340dfae9bbdf2db306fce669fe8e0f987696749
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jul 18, 2022
Research Description: Name Directory [name-directory] < 1.25.5 WordPress Name Directory plugin <= 1.25.4 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability discovered by WPScanTeam in WordPress Name Directory plugin (versions <= 1.25.4). Update the WordPress Name Directory plugin to the latest available version (at least 1.25.5).
Affected versions: max 1.25.5.
Status: vulnerable

Name Directory # cfaaa828-20d1-4d68-83af-bae589ed8db4

CVE, Research URL: cfaaa828-20d1-4d68-83af-bae589ed8db4
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: -
Research Description: Name Directory [name-directory] < 1.18 Name Directory < 1.18 - Cross-Site Request Forgery (CSRF) The plugin was affected by CSRF issues, allowing attackers to make a logged in administrator perform unwanted actions
Affected versions: max 1.18.
Status: vulnerable

Name Directory # b63ef0c9-3f2f-47cf-98ab-9e82b07b1c9d

CVE, Research URL: b63ef0c9-3f2f-47cf-98ab-9e82b07b1c9d
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: -
Research Description: Name Directory [name-directory] < 1.25.5 Name Directory < 1.25.5 - Stored Cross-Site Scripting via CSRF The plugin does not have CSRF check when adding/editing names, and is also lacking sanitisation as well as escaping in some of the fields, which could allow attackers to make a logged in admin edit arbitrary names and put XSS payloads in them.
Affected versions: max 1.25.5.
Status: vulnerable

Name Directory # 9a9e0665-7a36-4d96-9295-5b7ec626661a

CVE, Research URL: 9a9e0665-7a36-4d96-9295-5b7ec626661a
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: -
Research Description: Name Directory [name-directory] < 1.25.4 Name Directory < 1.25.4 - Arbitrary Directory/Name Deletion via CSRF The plugin does not have CSRF checks in place when deleting Directories and Names, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected versions: max 1.25.4.
Status: vulnerable

Apr 15, 2026

Name Directory # CVE-2026-3178

CVE, Research URL: CVE-2026-3178
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Mar 11, 2026
Research Description: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1.
Affected versions: max 1.33.0.
Status: vulnerable

Name Directory # CVE-2026-1866

CVE, Research URL: CVE-2026-1866
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Feb 10, 2026
Research Description: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling `html_entity_decode()` before `wp_kses()`, and then calling `html_entity_decode()` again on output. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the 'name_directory_name' and 'name_directory_description' parameters in the public submission form granted they can trick the site administrator into approving their submission or auto-publish is enabled.
Affected versions: max 1.32.1.
Status: vulnerable

Jan 27, 2026

Name Directory # CVE-2025-15283

CVE, Research URL: CVE-2025-15283
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jan 14, 2026
Research Description: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters in all versions up to, and including, 1.30.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.31.0.
Status: vulnerable

Apr 21, 2025

Name Directory # CVE-2025-39454

CVE, Research URL: CVE-2025-39454
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: May 19, 2025
Research Description: Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.
Affected versions: max 1.30.1.
Status: vulnerable

Aug 30, 2024

Name Directory # CVE-2024-43938

CVE, Research URL: CVE-2024-43938
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Sep 18, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.
Affected versions: max 1.29.1.
Status: vulnerable

Jun 07, 2024

Name Directory # CVE-2021-20652

CVE, Research URL: CVE-2021-20652
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Feb 05, 2021
Research Description: Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Affected versions: max 1.18.
Status: vulnerable

Name Directory # CVE-2023-22692

CVE, Research URL: CVE-2023-22692
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: May 22, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeroen Peters Name Directory plugin <= 1.27.1 versions.
Affected versions: max 1.27.2.
Status: vulnerable

Name Directory # CVE-2022-2072

CVE, Research URL: CVE-2022-2072
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jul 25, 2022
Research Description: The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
Affected versions: max 1.25.4.
Status: vulnerable

Name Directory # CVE-2022-2071

CVE, Research URL: CVE-2022-2071
Home page URL: Security reports for Name Directory
Application: Name Directory
Date: Jul 25, 2022
Research Description: The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.
Affected versions: max 1.25.4.
Status: vulnerable