MEDIUM
jeroenpeters1986
CVE published 2026-10-16
CVE-2026-104726
The Name Directory plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute when a user accesses an injected page. The vulnerability was reported by [email protected] and defen [truncated]