Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution via Public Name Submission Description
- ID
- WPSEC-2026-0356
- Plugin
- Name Directory (name-directory)
- Affected
- from 1.16 before 1.34.3
- Remediation
- Update to 1.34.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Name Directory on WPSec AttackSurface
- Fix released
- Published
Description
The Name Directory plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 1.16 up to, and including, 1.34.2 due to the plugin passing entry descriptions, including those submitted by visitors through the public front-end submission form, to do_shortcode() when rendering directory entries, while the submission sanitiser removes HTML but leaves shortcode syntax intact. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes, which may disclose information or reach functionality otherwise restricted to privileged users. Exploitation requires that the directory's public submission form is enabled and that the submitted entry is published (submissions are held for administrator approval by default) and displayed with descriptions shown.
References
- https://wpsec.com/vuln/WPSEC-2026-0356/
- https://plugins.svn.wordpress.org/name-directory/tags/1.34.3/
- https://wordpress.org/plugins/name-directory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS