What the vulnerability does
01Description
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling `html_entity_decode()` before `wp_kses()`, and then calling `html_entity_decode()` again on output. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the 'name_directory_name' and 'name_directory_description' parameters in the public submission form granted they can trick the site administrator into approving their submission or auto-publish is enabled.
Explanation of Vulnerability in Simple Terms
02Summary
Name Directory versions up to 1.32.0 contain a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts. The vulnerability affects the application's scope beyond the vulnerable component itself. No user interaction is required for exploitation. Site administrators should update to a version newer than 1.32.0.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that executes in users' browsers and affects other parts of the application.
Potential impact on your site
04Site Impact
Visitors may have malicious scripts executed in their browsers, potentially compromising their sessions or data.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 10, 2026
CVE published
April 8, 2026
Record updated
