Name Directory CVE-2026-104726

Exploitation requires an authenticated account with contributor-level privileges or higher on a WordPress site running the Name Directory plugin version 1.34.2 or earlier; the attacker injects the payload through the 'dir' attribute of the plugin's shortcode. Execution of the stored script is triggered when any user subsequently accesses the page containing the injected shortcode, so impact depends on a victim viewing that content. Limiting factors: the contributor authentication requirement (sites that restrict or vet user registration greatly reduce exposure), the need for the vulnerable plugin to be installed and the malicious shortcode to be rendered on a viewed page, and the fact that the issue is remediated in version 1.34.3.

This is a moderate-severity stored XSS (CVSS 6.4, CWE-79) with signals that collectively point to a low-to-moderate real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold an authenticated contributor-level (or higher) account, which is a meaningful barrier on well-managed sites and limits the viable attacker population to insiders or compromised/registration-open accounts. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - exploitation status and probability signals are simply absent, not conflicting. The scope change (S:C) and only Low confidentiality/integrity impacts are consistent with XSS executing in a victim's browser rather than full server compromise. Net: a legitimate patch-worthy issue, but not a drop-everything priority given the authentication prerequisite and absence of exploitation evidence.

An attacker who holds (or registers for) a contributor-level account on a WordPress site running Name Directory ≤1.34.2 embeds a malicious payload in the 'dir' shortcode attribute within a post or page. When an administrator or other user later views the page containing that injected directory shortcode, the script executes in their browser session. No public exploit code is identified at time of analysis, but the low attack complexity makes exploitation straightforward for any user with the required role.