The Name Directory plugin for WordPress contains a stored cross‑site scripting vulnerability that originates from insufficient input sanitization and output escaping of the 'name_directory_name' parameter. An unauthenticated attacker can inject arbitrary JavaScript which will execute for any user who views an affected page, allowing for session hijacking, cookie theft, or defacement. This flaw corresponds to CWE‑79.

The affected product is Name Directory by jeroenpeters1986. All releases up to and including version 1.32.1 contain the flaw. The vulnerability was only partially remediated in releases 1.30.3 and 1.32.1, so those versions are still vulnerable.

The vulnerability has a CVSS score of 7.2, indicating moderate to high severity, but the EPSS score is less than 1 %, indicating a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. Because the flaw is exploitable by unauthenticated users, the likely attack vector is a web request that injects malicious payloads into the name_directory_name field; successful exploitation requires only the ability to submit that parameter to the site, making it straightforward for attackers.