Name Directory CVE-2026-104396

Exploitation requires an authenticated account with at least low privileges that can submit or edit Name Directory entries (PR:L), and the stored payload only fires when a victim - typically an administrator or site visitor - subsequently views the affected directory page (UI:R). Limiting factors: the attacker must already be able to author directory content, the payload is inert until another user loads the page, and impact is confined to browser-context script execution (C:L/I:L/A:L) rather than direct server takeover. Realistic exposure is highest on sites that allow untrusted or multiple contributors to populate directory listings; single-admin sites with no untrusted authenticated users face minimal practical risk.

This is a Patchstack-reported stored XSS (CWE-79) in the Name Directory WordPress plugin with a moderate CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-reachable, low-complexity attack that requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in other users'/admins' browser context rather than the vulnerable component itself. Impacts are rated Low across confidentiality, integrity, and availability - consistent with typical stored XSS rather than direct server compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency is therefore driven by the vulnerability class and the plugin's footprint, not by observed in-the-wild activity. Net assessment: a genuine but second-tier priority - meaningful where the plugin is deployed and untrusted contributors can submit directory entries, but not an emergency absent exploitation signals. Missing data to note explicitly: EPSS probability is absent (cannot gauge likelihood of widespread exploitation), KEV status is not confirmed, and POC availability is unknown.

A low-privileged authenticated user (e.g., a contributor or a user permitted to submit/edit name-directory entries) injects a malicious script payload into a stored field of the Name Directory plugin. When an administrator or another visitor later views the affected directory page, the stored script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified in the provided data.