Stored cross‑site scripting (XSS) exists in the Jeroen Peters Name Directory WordPress plugin. The plugin fails to properly neutralize user‑supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript that will execute in the context of any site visitor. Because the script is stored, every user who views the compromised content could suffer session hijacking, defacement, credential theft, or the delivery of further attacks.

The vulnerability affects the Name Directory plugin for WordPress developed by Jeroen Peters. All installations running version 1.34.2 or older are susceptible; the issue is present in every release from the earliest up through 1.34.2. Upgrading to at least 1.34.3 patches the flaw.

The CVSS v3 score of 6.5 indicates moderate risk, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw through the web interface by submitting input that will be stored and later rendered without sanitization; this requires access to content creation or submission capabilities within the plugin. Because the payload is stored, a single successful injection affects all visitors to the compromised page, so the potential impact scales with the number of users. The lack of an EPSS score does not preclude exploitation; the vulnerability exists in a widely used plugin and is a classic stored XSS flaw.