CVE-2026-88792

8.8 highEPSS 0.5%

High (8.8). EPSS 0.5% chance of exploitation in the next 30 days.

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-17
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/

Check your stack JSON