CVE-2026-3178: WordPress Name Directory XSS Vulnerability

CVE-2026-3178 Overview

The Name Directory plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the name_directory_name parameter affecting all versions up to and including 1.32.1. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page. This vulnerability was partially patched in versions 1.30.3 and 1.32.1, but the fix was incomplete.

Critical Impact

Unauthenticated attackers can inject persistent malicious scripts that execute in the context of any user viewing the affected pages, potentially leading to session hijacking, credential theft, and administrative account compromise.

Affected Products

• Name Directory plugin for WordPress versions up to and including 1.32.1
• Name Directory plugin for WordPress versions 1.30.3 and 1.32.1 (partially patched)

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-3178 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-3178

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability arises from improper handling of user-supplied input in the Name Directory plugin. The plugin fails to properly sanitize the name_directory_name parameter before storing it in the database and subsequently fails to escape the output when rendering it on web pages. This allows attackers to persist malicious JavaScript code that executes in the browser context of any user who views the affected content.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). What makes this particularly dangerous is that the attack can be performed by unauthenticated users, meaning no login credentials are required to exploit the flaw. The stored nature of the XSS means the malicious payload persists across sessions and can affect multiple users over time.

Root Cause

The root cause lies in the admin.php and helpers.php files within the plugin, specifically around lines 930-931 in admin.php and line 602 in helpers.php. The plugin implements insufficient input sanitization when processing the name_directory_name parameter and fails to apply proper output escaping when displaying user-controlled content. This dual failure—at both input validation and output encoding stages—creates a pathway for XSS attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction to inject the payload. An attacker submits a crafted request containing malicious JavaScript within the name_directory_name parameter. Since the plugin stores this unsanitized input directly, the script becomes part of the page content. When any user subsequently loads a page containing the injected script, the malicious code executes in their browser session.

Attackers can exploit this vulnerability to steal session cookies, redirect users to phishing sites, modify page content, or perform actions on behalf of authenticated users including administrators.

Detection Methods for CVE-2026-3178

Indicators of Compromise

• Presence of unexpected JavaScript code in Name Directory entries or database records
• Suspicious <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript in name_directory_name fields
• Unusual network requests originating from WordPress pages to external domains
• Reports of unexpected browser behavior or redirects from users viewing Name Directory content

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in incoming requests targeting the Name Directory plugin endpoints
• Deploy Content Security Policy (CSP) headers to restrict script execution and report violations
• Monitor WordPress database for entries containing suspicious HTML or JavaScript in Name Directory tables
• Review server access logs for POST requests to Name Directory endpoints containing script tags or encoded payloads

Monitoring Recommendations

• Enable WordPress audit logging to track changes to Name Directory entries
• Configure real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
• Regularly scan stored content in the Name Directory plugin tables for malicious scripts
• Monitor for unusual admin account activity that could indicate session hijacking

How to Mitigate CVE-2026-3178

Immediate Actions Required

• Update the Name Directory plugin to the latest available version beyond 1.32.1 when a complete patch is released
• Review and audit all existing Name Directory entries for potentially malicious content
• Implement a Web Application Firewall with XSS protection rules enabled
• Consider temporarily disabling the Name Directory plugin if it is not critical to operations until a complete fix is available

Patch Information

The vulnerability was partially addressed in versions 1.30.3 and 1.32.1, but the fixes were incomplete. Administrators should monitor the WordPress Plugin Changeset for the latest security updates. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-side input validation to strip or encode HTML entities from the name_directory_name parameter
• Deploy Content Security Policy headers with strict script-src directives to mitigate the impact of injected scripts
• Restrict access to Name Directory submission forms to authenticated users only if possible
• Use a security plugin that provides XSS filtering and input sanitization for WordPress

# Example: Add CSP header in Apache .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# Example: Add CSP header in Nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";