High · published February 10, 2026
⚡ Double HTML-entity encoding is the sneaky trick in the Name Directory plugin for WordPress that allows unauthenticated attackers to inject malicious scripts! 🔥 Think of it like a restaurant where the chef keeps accepting orders without verifying the ingredients — even if someone asks for a dish that includes something dangerous, it goes right out to the customers! That's what's happening here with those injected scripts. If exploited, an attacker could unleash arbitrary scripts that run in users' browsers, potentially stealing sensitive information or compromising their sessions. It's like allowing a stranger to slip a note into a customer's meal — who knows what they might write? This could lead to a wave of misinformation or worse among your users!
Think of it like a restaurant where the chef keeps accepting orders without verifying the ingredients — even if someone asks for a dish that includes something dangerous, it goes right out to the customers! That's what's happening here with those injected scripts. This vulnerability arises because the Name Directory plugin's sanitization function calls `html_entity_decode()` before `wp_kses()`, and then again on output, creating a loophole for attackers to inject malicious web scripts through user-submitted content.
If exploited, an attacker could unleash arbitrary scripts that run in users' browsers, potentially stealing sensitive information or compromising their sessions. It's like allowing a stranger to slip a note into a customer's meal — who knows what they might write? This could lead to a wave of misinformation or worse among your users! To protect your site, update the Name Directory plugin to version 1.32.1 or later immediately. Additionally, consider implementing stricter content moderation practices to ensure only safe submissions are approved. You've got this! Follow these steps, and your site will be back on the path to safety in no time! 🛡️