Stored Cross-Site Scripting in Name Directory Plugin for WordPress

CVE-2026-1866

What is CVE-2026-1866?

The Name Directory plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting due to improper handling of HTML-entity encoding. This flaw stems from the plugin's sanitization process, which calls html_entity_decode() prior to using wp_kses(), and subsequently calls html_entity_decode() again upon output. As a result, unauthenticated attackers can exploit this weakness to inject malicious web scripts through the 'name_directory_name' and 'name_directory_description' parameters in the public submission form. Attackers may gain execution of arbitrary scripts on pages visited by users if they can convince a site administrator to approve their submission or if automatic publishing is enabled.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References