CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

122 matches found

NVD•added 2026/03/11 12:15 p.m.•18 views

CVE-2026-3178

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'namedirectoryname' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.2CVSS0.00421EPSS

SaveExploits0References5

attackerkb•added 2026/03/11 11:09 a.m.•11 views

CVE-2026-3178

7.2CVSS5.9AI score0.00421EPSS

SaveExploits0References6

Vulnrichment•added 2026/03/11 11:09 a.m.•11 views

CVE-2026-3178 Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'

7.2CVSS6.2AI score0.00421EPSS

SaveExploits0References5

Cvelist•added 2026/03/11 11:09 a.m.•46 views

CVE-2026-3178 Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'

7.2CVSS0.00421EPSS

SaveExploits0References5

CVE•added 2026/03/11 11:09 a.m.•28 views

CVE-2026-3178

The CVE concerns the WordPress Name Directory plugin (affected: all versions up to 1.32.1) and a Stored XSS via the name_directory_name parameter. The vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts into pages that...

7.2CVSS6.2AI score0.00421EPSS

SaveExploits0References5

Positive Technologies•added 2026/03/11 12:00 a.m.•14 views

PT-2026-24666

🚨 CVE-2026-3178 The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name directory name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

7.2CVSS6AI score0.00421EPSS

SaveExploits0References9

Rapid7 Vulnerability Database (full)•added 2026/03/11 12:00 a.m.•5 views

CVE-2026-3178: Improper Neutralization of Input During Web Page Generation

7.2CVSS6.1AI score0.00421EPSS

SaveExploits0References1

RedhatCVE•added 2026/02/11 1:16 p.m.•19 views

CVE-2026-1866

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling htmlentitydecode before wpkses, and then calling htmlentitydecode again on...

7.2CVSS5.6AI score0.00298EPSS

SaveExploits0References1

NVD•added 2026/02/10 10:15 a.m.•24 views

CVE-2026-1866

7.2CVSS0.00298EPSS

SaveExploits0References5

Cvelist•added 2026/02/10 9:26 a.m.•56 views

CVE-2026-1866 Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form

7.2CVSS0.00298EPSS

SaveExploits0References5

Vulnrichment•added 2026/02/10 9:26 a.m.•11 views

CVE-2026-1866 Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form

7.2CVSS5.9AI score0.00298EPSS

SaveExploits0References5

CVE•added 2026/02/10 9:26 a.m.•72 views

CVE-2026-1866

The WordPress plugin Name Directory (vulnerable up to 1.32.0) is affected by a Stored XSS due to double HTML-entity encoding in its sanitization flow. The plugin decodes HTML entities before wp_kses and decodes output again, enabling unauthenticated attackers to inject scripts via the public subm...

7.2CVSS5.9AI score0.00298EPSS

SaveExploits0References5

attackerkb•added 2026/02/10 9:26 a.m.•13 views

CVE-2026-1866

7.2CVSS5.6AI score0.00298EPSS

SaveExploits0References6

Patchstack•added 2026/02/10 9:10 a.m.•18 views

WordPress Name Directory plugin <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form vulnerability

Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form vulnerability discovered by duy.thai in WordPress Plugin Name Directory versions = 1.32.0...

7.2CVSS5.4AI score0.00298EPSS

SaveExploits0References1Affected Software1

Rapid7 Vulnerability Database (full)•added 2026/02/10 12:00 a.m.•5 views

CVE-2026-1866: Improper Neutralization of Input During Web Page Generation

7.2CVSS5.8AI score0.00298EPSS

SaveExploits0References1

Positive Technologies•added 2026/02/10 12:00 a.m.•46 views

PT-2026-7246

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling html entity decode before wp kses, and then calling html entity decode again...

7.2CVSS5.7AI score0.00298EPSS

SaveExploits0References6

RedhatCVE•added 2026/01/15 6:21 a.m.•22 views

CVE-2025-15283

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'namedirectoryname' and 'namedirectorydescription' parameters in all versions up to, and including, 1.30.3 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS5.1AI score0.0036EPSS

SaveExploits0References1

Patchstack•added 2026/01/14 1:53 p.m.•20 views

WordPress Name Directory plugin <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters vulnerability

Unauthenticated Stored Cross-Site Scripting via Multiple Parameters vulnerability discovered by zer0gh0st in WordPress Plugin Name Directory versions = 1.30.3...

7.2CVSS5.7AI score0.0036EPSS

SaveExploits0References1Affected Software1

NVD•added 2026/01/14 6:15 a.m.•24 views

CVE-2025-15283

7.2CVSS0.0036EPSS

SaveExploits0References4

Vulnrichment•added 2026/01/14 5:28 a.m.•11 views

CVE-2025-15283 Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters

7.2CVSS6.1AI score0.0036EPSS

SaveExploits0References3

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by