CVE-2026-3178

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3178", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-25T00:16:35.339Z", "datePublished": "2026-03-11T11:09:10.516Z", "dateUpdated": "2026-04-08T16:47:59.407Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:59.407Z"}, "affected": [{"vendor": "jeroenpeters1986", "product": "Name Directory", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.32.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1."}], "title": "Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebac8bc-1dca-4bcd-a033-fb8ed210bf4e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L931"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L930"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/helpers.php#L602"}, {"url": "https://plugins.trac.wordpress.org/changeset/3478625"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "timeline": [{"time": "2026-03-06T00:40:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:15:38.939577Z", "id": "CVE-2026-3178", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:17:48.601Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3178", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T13:15:38.939577Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:17:27.710Z"}}], "cna": {"title": "Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'", "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jeroenpeters1986", "product": "Name Directory", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.32.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-06T00:40:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebac8bc-1dca-4bcd-a033-fb8ed210bf4e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L931"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L930"}, {"url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/helpers.php#L602"}, {"url": "https://plugins.trac.wordpress.org/changeset/3478625"}], "descriptions": [{"lang": "en", "value": "The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:59.407Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3178", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:59.407Z", "dateReserved": "2026-02-25T00:16:35.339Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T11:09:10.516Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Name Directory", "vendor": "jeroenpeters1986", "versions": [{"lessThanOrEqual": "1.32.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1."}, {"lang": "es", "value": "El plugin Name Directory para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'name_directory_name' en todas las versiones hasta la 1.32.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La vulnerabilidad fue parcialmente parcheada en las versiones 1.30.3 y 1.32.1."}], "id": "CVE-2026-3178", "lastModified": "2026-06-17T10:43:09.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3178", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:15:38.939577Z", "version": "2.0.3"}}]}, "published": "2026-03-11T12:15:54.523", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L930"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/admin.php#L931"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/name-directory/trunk/helpers.php#L602"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3478625"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebac8bc-1dca-4bcd-a033-fb8ed210bf4e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.32.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Name Directory", "source": "cna", "vendor": "jeroenpeters1986"}, "product": "name_directory", "vendor": "jeroenpeters1986"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T16:02:29.283798+00:00", "value": {"mitigation_remediation": ["Update the Name Directory plugin to the latest stable release (any version newer than 1.32.1).", "If an update is not immediately possible, remove or deactivate the plugin until a patched version is available.", "Scan the site for malicious scripts inserted through the vulnerable parameter and remove any that are found.", "Restrict access to the plugin\u2019s admin interface via IP whitelisting or authentication to reduce the attack surface.", "Monitor site logs for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The affected product is Name Directory by jeroenpeters1986. All releases up to and including version 1.32.1 contain the flaw. The vulnerability was only partially remediated in releases 1.30.3 and 1.32.1, so those versions are still vulnerable.", "description_and_impact": "The Name Directory plugin for WordPress contains a stored cross\u2011site scripting vulnerability that originates from insufficient input sanitization and output escaping of the 'name_directory_name' parameter. An unauthenticated attacker can inject arbitrary JavaScript which will execute for any user who views an affected page, allowing for session hijacking, cookie theft, or defacement. This flaw corresponds to CWE\u201179.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.2, indicating moderate to high severity, but the EPSS score is less than 1\u202f%, indicating a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. Because the flaw is exploitable by unauthenticated users, the likely attack vector is a web request that injects malicious payloads into the name_directory_name field; successful exploitation requires only the ability to submit that parameter to the site, making it straightforward for attackers."}}}}, "created": "2026-03-12T10:06:01.843782+00:00", "updated": "2026-03-20T14:37:22.881276+00:00", "vendors": ["jeroenpeters1986", "jeroenpeters1986$PRODUCT$name_directory", "wordpress", "wordpress$PRODUCT$wordpress"]}