The WordPress plugin Name Directory is vulnerable to stored Cross‑Site Scripting through the name_directory_name and name_directory_description parameters. Because input is not properly sanitized or escaped, attackers can inject malicious scripts that are stored and later executed whenever any user visits a page that displays the stored content. This elevates the attacker’s ability to steal session cookies, deface sites, or perform other client side attacks. The weakness corresponds to a classic insecure input handling flaw (CWE‑79).

This flaw exists in all releases of the Name Directory plugin up to and including version 1.30.3. The affected product is the WordPress plugin known as Name Directory, provided by the vendor jeroenpeters1986. All installations of the plugin that have not been upgraded beyond 1.30.3 are vulnerable. There is no further version restriction listed beyond the cutoff.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score is below 1 %, reflecting a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no documented active exploitation. Attackers would typically exploit the flaw by submitting malicious payloads via the vulnerable parameters, which are stored by the plugin and rendered in subsequent page loads. Because the attack does not require authentication, any user can exploit the flaw to inject scripts into the site’s public pages.