CVE-2026-1866 PUBLISHED

Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form

Assigner: Wordfence
Reserved: 03.02.2026 Published: 10.02.2026 Updated: 10.02.2026

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling html_entity_decode() before wp_kses(), and then calling html_entity_decode() again on output. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the 'name_directory_name' and 'name_directory_description' parameters in the public submission form granted they can trick the site administrator into approving their submission or auto-publish is enabled.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 7.2

Product Status

Vendor jeroenpeters1986
Product Name Directory
Versions Default: unaffected
  • affected from * to 1.32.0 (incl.)

Credits

  • Duy Thai finder

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE