{"id":"CVE-2026-6395","aliases":["EUVD-2026-31041","GHSA-p637-7ww8-j45c"],"status":"published","title":"Word 2 Cash \u003c= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page","description":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a \u003ctextarea\u003e element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00153,"percentile":0.04517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2026-05-20T01:25:56Z","modified":"2026-07-24T08:10:00Z","products":[{"vendor":"winking","product":"word 2 cash"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7ca5c-38aa-4413-83eb-29185cca2a74?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L31"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L31"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L20"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L20"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L18"},{"url":"https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L18"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6395"},{"url":"https://github.com/advisories/GHSA-p637-7ww8-j45c"}],"sources":{"cve":[{"id":"CVE-2026-6395","title":"Word 2 Cash \u003c= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page","description":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a \u003ctextarea\u003e element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.","status":"published","published":"2026-05-20T01:25:56.234Z","modified":"2026-05-20T12:06:13.297Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-31041","description":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a \u003ctextarea\u003e element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.","status":"published","published":"2026-05-20T01:25:56Z","modified":"2026-05-20T12:06:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:14.831553Z"}],"ghsa":[{"id":"GHSA-p637-7ww8-j45c","title":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to...","description":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a \u003ctextarea\u003e element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.","status":"published","published":"2026-05-20T03:31:34Z","modified":"2026-05-20T03:31:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:08:12.634242Z"}],"nvd":[{"id":"CVE-2026-6395","description":"The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a \u003ctextarea\u003e element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.","status":"published","published":"2026-05-20T02:16:37.627Z","modified":"2026-07-24T08:10:00.15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:19.752984Z"}]}}