CVE-2026-74933
GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 13, 2026
- Updated
- Sep 14, 2026
- Reserved
- Aug 17, 2026
Description
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | WPScan |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
GenieWordsUnknown |
|
References
- https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.