The Name Directory WordPress plugin allows unauthenticated attackers to embed malicious scripts in plug‑in stored data by double‑encoding HTML entities during sanitization and re‑decoding them on output. The flaw turns user input in the public submission form into executable code when a page containing the stored data is viewed, enabling session hijacking, malware delivery, or defacement.

WordPress sites running any release of the Name Directory plugin up to and including 1.32.0, developed by jeroenpeters1986. The vulnerability applies to every instance where the public submission form is enabled and the name_directory_name and name_directory_description fields are processed.

With a CVSS score of 7.2 the flaw poses a moderate‑to‑high risk. The EPSS score is below 1 %, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw only when a submission is publicly available—either when auto‑publication is enabled or when an administrator approves a malicious entry. Thus, the attack vector is local to the community of site administrators who grant publication privileges to public submissions.