Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Name Directory Project Clear all filters
TI-2022-01919 CVE-2022-2072 · GHSA-mg3f-7p64-q5jf

Name Directory < 1.25.3 - Reflected Cross-Site Scripting

Priority LOW 28

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00694 Published 2022-07-25 Fixed in 1.25.3 CWE-79
TI-2022-01918 CVE-2022-2071 · GHSA-w657-gq68-34f2

Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF

Priority LOW 27

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a lo…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2022-07-25 Fixed in 1.25.4 CWE-352
TI-2021-03879 CVE-2021-20652 · GHSA-322w-f24m-rgpr

Cross-site request forgery in J. Peters Name Directory

Priority MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0085 Published 2021-02-05 No fix listed CWE-352