CVE-2026-3620
Stored XSS in Word Replacer WordPress Plugin
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| word_replacer | word_replacer | to 0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Word Replacer plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'replacement' parameter in all versions up to and including 0.4.
This vulnerability exists because the plugin does not properly sanitize input or escape output, allowing attackers to inject malicious web scripts.
An attacker with Administrator-level access or higher can exploit this to insert arbitrary scripts that execute whenever a user views the affected page.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated administrator attacker to inject malicious scripts into web pages.
When other users access these pages, the injected scripts will execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.
Because the attacker needs high-level privileges, the risk is somewhat limited to insiders or compromised admin accounts, but the impact on confidentiality and integrity can be significant.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'replacement' parameter in the Word Replacer plugin for WordPress. Detection typically requires inspecting the plugin's usage and the content of pages where the 'replacement' parameter is used.
Since the vulnerability requires authenticated Administrator-level access to inject scripts, detection can involve reviewing the WordPress plugin version to confirm if it is up to and including version 0.4, which is vulnerable.
There are no specific commands provided in the available context or resources to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by insufficient input sanitization and output escaping in the Word Replacer plugin versions up to 0.4.
Immediate mitigation steps include updating the Word Replacer plugin to a version later than 0.4 if available, or disabling the plugin until a fix is applied.
Additionally, restricting Administrator-level access to trusted users can reduce the risk of exploitation.