CVE-2026-1866: Name Directory WordPress Plugin XSS Flaw

CVE-2026-1866 Overview

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via double HTML-entity encoding in all versions up to and including 1.32.0. This vulnerability exists due to a flawed sanitization implementation where the plugin calls html_entity_decode() before wp_kses(), and then calls html_entity_decode() again on output. This double-decode sequence allows unauthenticated attackers to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

The attack vector leverages the name_directory_name and name_directory_description parameters in the public submission form. Successful exploitation requires either tricking the site administrator into approving a malicious submission or exploiting sites where auto-publish is enabled.

Critical Impact

Unauthenticated attackers can inject persistent malicious scripts that execute in the browsers of all users who view affected pages, potentially leading to credential theft, session hijacking, or malware distribution.

Affected Products

• Name Directory WordPress Plugin versions up to and including 1.32.0
• WordPress installations with Name Directory plugin public submission forms enabled
• Sites with Name Directory auto-publish feature enabled

Discovery Timeline

• 2026-02-10 - CVE CVE-2026-1866 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-1866

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from improper input sanitization order in the Name Directory plugin's content processing flow. The plugin implements a sanitization routine that incorrectly sequences HTML entity decoding operations with the WordPress security function wp_kses().

When user input is submitted through the public form, the plugin processes it by first calling html_entity_decode() to convert HTML entities back to their character equivalents, then applies wp_kses() for filtering dangerous content. However, the plugin then calls html_entity_decode() again when outputting the content. This sequence creates a bypass opportunity where double-encoded HTML entities survive the initial sanitization pass and are decoded into executable script tags on output.

The vulnerability affects the name_directory_name and name_directory_description parameters, which are accessible through the plugin's public submission form without authentication. This allows external attackers to submit malicious payloads that persist in the WordPress database and execute in the context of any user viewing the affected directory pages.

Root Cause

The root cause lies in the improper order of sanitization operations in the plugin's helpers.php file at line 604 and the shortcode rendering functions. The sanitization function calls html_entity_decode() before applying wp_kses(), which defeats the purpose of the security filter. When html_entity_decode() is called again during output rendering in shortcode.php, any double-encoded malicious content bypasses the wp_kses() filter entirely.

For example, a payload like &lt;script&gt; would be decoded to <script> before wp_kses() sees it (which appears harmless), then decoded again to <script> on output, resulting in script execution.

Attack Vector

The attack is delivered over the network through the plugin's public submission form. Attackers can submit directory entries containing double HTML-entity encoded XSS payloads in the name or description fields. If the site has auto-publish enabled, the malicious content becomes immediately available to all visitors. Otherwise, the attacker must employ social engineering to convince an administrator to approve the submission.

Once injected, the malicious scripts execute in the browser context of any user viewing the affected directory page, including administrators. This can lead to session hijacking, credential theft, defacement, or further attacks against the WordPress installation.

Detection Methods for CVE-2026-1866

Indicators of Compromise

• Presence of double HTML-entity encoded strings (e.g., &amp;lt;script) in Name Directory database entries
• Unexpected JavaScript execution or browser alerts when viewing Name Directory pages
• Suspicious entries in the Name Directory with encoded special characters in name or description fields
• Web application firewall logs showing attempts to submit encoded script tags to WordPress forms

Detection Strategies

• Implement WAF rules to detect double-encoded HTML entities in form submissions targeting WordPress sites
• Monitor database tables associated with Name Directory plugin for entries containing suspicious encoded patterns
• Deploy browser-based XSS detection tools to identify unauthorized script execution on WordPress pages
• Review Name Directory pending submissions for entries containing HTML entity patterns

Monitoring Recommendations

• Enable detailed logging for WordPress plugin form submissions to capture potential attack attempts
• Configure security plugins to alert on suspicious content patterns in user-submitted data
• Monitor outbound network connections from user browsers that may indicate XSS payload execution
• Implement Content Security Policy (CSP) headers to detect and report unauthorized script execution

How to Mitigate CVE-2026-1866

Immediate Actions Required

• Update the Name Directory plugin to a version newer than 1.32.0 that addresses this vulnerability
• Disable the public submission form feature if updates are not immediately available
• Disable auto-publish functionality for Name Directory submissions until patching is complete
• Review and purge any suspicious existing entries in the Name Directory database

Patch Information

The fix for this vulnerability is available in the WordPress Plugin Changeset 3455023. The patch corrects the sanitization order to prevent double-decoding attacks. Site administrators should update to the latest version through the WordPress plugin repository. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the Name Directory public submission form by removing or restricting access to submission functionality
• Require manual administrator approval for all directory submissions and carefully inspect entries before publishing
• Implement additional server-side input validation using WordPress hooks to sanitize Name Directory input
• Deploy a Web Application Firewall with rules to block double-encoded HTML entity patterns in form submissions

The vulnerability manifests in the plugin's sanitization sequence where html_entity_decode() is improperly called both before and after the wp_kses() security filter. For detailed technical analysis of the vulnerable code paths, refer to the WordPress Plugin Code Helper and WordPress Plugin Shortcode Function references.