CVE-2022-2072

CVE-2022-2072 affects the WordPress Name Directory plugin prior to 1.25.3. The vulnerability arises from insufficient sanitization/escaping of a parameter output back to the page, causing both Reflected and Stored XSS (payloads are saved to the database after the request). Connected sources confi...

CVE-2022-2071

CVE-2022-2071 affects the WordPress Name Directory plugin (versions prior to 1.25.4). The root cause is missing CSRF checks and insufficient sanitisation/escaping in imported data, enabling a logged-in admin to import names containing XSS payloads (stored XSS). Exploitation details in connected s...