plugin
24 known security issues reported for the Name Directory WordPress plugin. Most recent disclosed Mar 12, 2026.
Running Name Directory on your site? Check whether your installed version is affected.
Scan your site freeUnauthenticated Stored Cross-Site Scripting via 'name_directory_name' vulnerability
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pa...
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling `html_entity_decode()` before `wp_kses()`, and then calling `html_entity_decode()` again on output....
[en] The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters in all versions up to, and including, 1.30.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters in all versions up to, and including, 1.30.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
[en] Missing Authorization vulnerability in Jeroen Peters Name Directory.This issue affects Name Directory: from n/a through 1.30.0.
The Name Directory plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.30.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Peters Name Directory allows Reflected XSS.This issue affects Name Directory: from n/a through 1.29.0.
The Name Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Jeroen Peters Name Directory plugin <= 1.27.1 versions.
The Name Directory plugin for WordPress is vulnerable to Cross Site Request Forgery in versions up to, and including, 1.27.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administra...
[en] The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.
[en] The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability discovered by WPScanTeam in WordPress Name Directory plugin (versions <= 1.25.4). Update the WordPress Name Directory plugin to the latest available version (at least 1.25.5).
The Name Directory plugin for WordPress is vulnerable to unauthorized settings update due to insufficient permissions checking on the name_directory_options() function in versions up to, and including, 1.25.4. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to perform....
The Name Directory plugin for WordPress is vulnerable to unauthorized settings update due to insufficient permissions checking on the name_directory_options() function in versions up to, and including, 1.25.4. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to perform....
The Name Directory plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.25.3. This is due to missing or incorrect nonce validation when editing, deleting or naming directories. This makes it possible for unauthenticated attackers to trigger the above actions via forged re...
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered in the WordPress Name Directory plugin (versions <= 1.25.3). Update the WordPress Name Directory plugin to the latest available version (at least 1.25.4).
The Name Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘name’ parameter in versions up to, and including, 1.25.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can suc...
Cross-site request forgery vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
[en] Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
The plugin does not have CSRF check when adding/editing names, and is also lacking sanitisation as well as escaping in some of the fields, which could allow attackers to make a logged in admin edit arbitrary names and put XSS payloads in them.
The plugin does not have CSRF checks in place when deleting Directories and Names, which could allow attackers to make a logged in admin delete them via a CSRF attack
The plugin was affected by CSRF issues, allowing attackers to make a logged in administrator perform unwanted actions
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free