CVE-2026-74933

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Affected

GenieWords

CVSS v3.1 WPSCAN

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.50% chance of exploitation in the next 30 days, 42nd percentile

Published

2026-09-13

Updated

2026-09-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/

References

• CVE Record
• NVD entry