CVE-2026-1866 is a stored XSS vulnerability in the Name Directory plugin for WordPress caused by the plugin's sanitization function calling html_entity_decode() before wp_kses(), and again on output. This double decoding bypasses sanitization, enabling injection of arbitrary web scripts through public submission form parameters. The vulnerability affects all versions up to and including 1.32.0. Attackers do not require authentication but need administrative approval or auto-publish to trigger script execution in users' browsers.

Successful exploitation allows attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should disable public submissions or require manual review and approval of all submissions to prevent untrusted input from being published. Monitoring for suspicious submissions and applying web application firewall rules to detect XSS payloads may provide temporary mitigation.