{"id":"CVE-2026-88792","aliases":["EUVD-2026-81346","GHSA-4jcw-8rjx-mwgc"],"status":"published","title":"Dictionary \u003c= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00505,"percentile":0.43644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-17T06:00:11Z","modified":"2026-09-18T19:08:32Z","products":[{"vendor":"unknown","product":"dictionary"}],"references":[{"url":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88792"},{"url":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5"},{"url":"https://github.com/advisories/GHSA-4jcw-8rjx-mwgc"}],"sources":{"cve":[{"id":"CVE-2026-88792","title":"Dictionary \u003c= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","status":"published","published":"2026-09-17T06:00:11.81Z","modified":"2026-09-17T12:28:14.877Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-81346","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","status":"published","published":"2026-09-17T06:00:11Z","modified":"2026-09-17T12:28:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:13.536818Z"}],"ghsa":[{"id":"GHSA-4jcw-8rjx-mwgc","title":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping...","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","status":"published","published":"2026-09-17T06:30:34Z","modified":"2026-09-17T15:33:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:05.417571Z"}],"nvd":[{"id":"CVE-2026-88792","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","status":"published","published":"2026-09-17T06:16:51.99Z","modified":"2026-09-18T19:08:32.83Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:49.013904Z"}]}}