CVE-2026-3620
4.4 MEDIUMThe Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to...
Published: 2026-06-02 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 4.4 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- CWE
- CWE-20
Description
The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-3620
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php#L191
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php#L230
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php#L339
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php#L343
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php#L191
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php#L230
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php#L339
- [Other]https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php#L343
- [Other]https://www.wordfence.com/threat-intel/vulnerabilities/id/b827f0e1-b8ee-4015-a608-45505f43b324?source=cve
Related CVEs
Same CWE
- CVE-2026-12191 — A vulnerability was found in Comma AI Openpilot 0.11 (7.8 HIGH)
- CVE-2026-45013 — ApostropheCMS is an open-source Node.js content management system (8.1 HIGH)
- CVE-2026-54133 — jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP app... (9.8 CRITICAL)
- CVE-2026-47196 — Quest Bot is an opensource Discord Bot
- CVE-2026-50633 — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an atta... (8.1 HIGH)