CVE-2025-15283 is a stored cross-site scripting vulnerability in the Name Directory plugin for WordPress, affecting all versions up to and including 1.30.3. The issue stems from improper neutralization of input during web page generation, specifically in the 'name_directory_name' and 'name_directory_description' parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity in a scope-changing manner.

Successful exploitation enables unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting affected pages, potentially leading to data disclosure or manipulation of user interactions. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits have been reported in the wild.

No official patch or fix is currently available for this vulnerability. Users of the Name Directory plugin should monitor the vendor's announcements for updates. Until a fix is released, consider disabling or removing the plugin to prevent exploitation. Avoid using the vulnerable parameters or restrict access to pages using the plugin as a temporary mitigation.