The vulnerability is a stored cross‑site scripting flaw in the Name Directory plugin for WordPress. All releases up to version 1.34.2 accept user input for the ‘dir’ shortcode attribute without proper sanitization or escaping, allowing an authenticated contributor or higher to embed arbitrary JavaScript that is stored in the database and executed whenever a page containing the shortcode is rendered.

The WordPress plugin Name Directory by user jeroenpeters1986, versions 1.34.2 and earlier, is affected. No other vendors or product versions are listed as vulnerable.

The CVSS score of 6.4 indicates a moderate threat. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed widespread exploitation is known. The attacker must be authenticated with contributor-level access or higher, which limits the attack surface but still represents a risk to sites that grant such permissions. The flaw can be exploited by creating or editing content that includes the malicious shortcode, leading to script execution for users who view the affected pages.