CVE-2026-88792

HighCVSS 8.8

Published: 17/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries. This allows unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

Risk Assessment

An attacker can inject malicious scripts that execute in visitors' browsers, leading to session theft, phishing, or other attacks. This may compromise user trust and site security.

Recommendation

Update the Dictionary plugin to a version later than 1.0. Ensure the plugin enforces authorization, sanitization, and escaping of input data.

Other vulnerabilities in Dictionary WordPress plugin

CVE-2025-15697High
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.

Original NVD description (English source)

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS