CVE-2026-104396 Jeroen Peters CVE debrief

Who should care

Defenders responsible for WordPress site security, particularly those using the Name Directory plugin, should assess exposure and prioritize updating the plugin to prevent potential stored XSS attacks.

Why it matters

Defenders should prioritize verifying and updating the Name Directory plugin to prevent potential stored XSS attacks, as the vulnerability has a MEDIUM severity CVSS score of 6.5.

• Potential for stored XSS attacks on WordPress sites using the vulnerable plugin
• Need for defenders to verify and update the plugin to prevent exploitation
• Possible impact on site security and user trust if left unpatched

Technical summary

The Name Directory plugin for WordPress, version 1.34.2 and earlier, is vulnerable to stored Cross-site Scripting (XSS) attacks due to improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data breaches. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Defenders should prioritize verifying and updating the plugin to prevent potential stored XSS attacks.

Defensive priority

Defenders should prioritize verifying and updating the Name Directory plugin to prevent potential stored XSS attacks.

Recommended defensive actions

• Verify the Name Directory plugin version and update to a patched version if necessary
• Monitor for potential stored XSS attacks on the WordPress site
• Review and update the plugin's input validation and sanitization mechanisms

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the Patchstack database. The vulnerability was publicly disclosed on 2026-10-05T09:17:07.793Z. Defenders should verify the plugin version and review the CVE record and NVD entry for more information. The Patchstack database is a known source of vulnerability information, but its details are limited in this case. Further verification is necessary to ensure the vulnerability is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.