What is CVE-2026-3178?

CVE-2026-3178 is a security vulnerability in the Name Directory plugin for WordPress, affecting versions up to and including 1.32.1. It allows unauthenticated attackers to exploit stored cross-site scripting (XSS) via the ‘name_directory_name’ parameter due to insufficient input sanitization.

How does the vulnerability work?

The vulnerability allows attackers to inject malicious scripts into the ‘name_directory_name’ field of the plugin’s public submission form. When this input is stored and later displayed without proper sanitization, the scripts can execute in the browsers of users visiting the affected pages.

Who is affected by this vulnerability?

Any WordPress site using the Name Directory plugin version 1.32.1 or earlier is at risk. Administrators should check their plugin version to determine if they need to take action.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Name Directory plugin installed. If it is version 1.32.1 or earlier, your site is at risk and should be updated immediately.

How can I fix this vulnerability?

The vulnerability is fixed in version 1.33.0 of the Name Directory plugin. Administrators should update the plugin to this version or later to mitigate the risk.

What does the CVSS score of 7.2 indicate?

The CVSS score of 7.2 indicates a high severity level, suggesting that successful exploitation could lead to significant impacts, such as session hijacking or unauthorized actions on behalf of users.

What practical risks does this vulnerability pose?

The practical risks include unauthorized script execution in user browsers, which can lead to data theft, session hijacking, or even administrative takeover of the WordPress site.

What is the proof of concept demonstrating?

The proof of concept illustrates how an attacker can exploit the vulnerability by submitting a specially crafted payload through the public submission form. This payload, when stored and later displayed, executes JavaScript in the context of users visiting the affected page.

What steps should I take if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the Name Directory plugin until it can be updated. Additionally, review user access and monitor for any suspicious activity on your site.

What is stored cross-site scripting (XSS)?

Stored cross-site scripting (XSS) occurs when an attacker injects malicious scripts into a website, which are then stored on the server and executed in the browsers of users who access the affected content. This type of XSS can persist over time, affecting multiple users.

How does the vulnerability affect user sessions?

If exploited, the vulnerability can allow attackers to execute scripts that may steal session cookies or redirect users to malicious sites, compromising user accounts and potentially leading to unauthorized access.

What should I do after applying the patch?

After updating the Name Directory plugin to version 1.33.0 or later, monitor your site for any unusual activity and consider conducting a security audit to ensure no other vulnerabilities exist.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-3178: Name Directory <= 1.32.1 Unauthenticated Stored Cross-Site Scripting via 'name_directory_name' PoC, Patch Analysis & Rule

CVE ID CVE-2026-3178

Plugin name-directory

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 1.32.1

Patched Version 1.33.0

Disclosed March 9, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3178:
The root cause is insufficient input sanitization and output escaping for the ‘name_directory_name’ parameter. The vulnerability exists in the plugin’s public submission form handling. User-supplied input for the ‘name’ field is processed by the `name_directory_deep_sanitize_public_user_input` function in `name-directory/helpers.php`. The function’s pre-patch logic applies `wp_kses` to raw input after `wp_unslash`. However, it fails to decode HTML entities before sanitization. This allows an attacker to submit a payload containing HTML-encoded characters (e.g., `