CVE-2026-88792
Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
HIGH 8.8EPSS 0.5%
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
- Affected
- Dictionary
- CVSS v3.1 CNA
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.51% chance of exploitation in the next 30 days, 42nd percentile
- Published
- 2026-09-17