What is the CVSS score of CVE-2026-3620?

CVE-2026-3620 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Word Replacer CVE-2026-3620

EUVD-2026-33895 MEDIUM

Improper Input Validation (CWE-20)

2026-06-02 Wordfence

GHSA-px2q-qrrj-jj65

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:48 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.4

DescriptionCVE.org

The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Word Replacer WordPress plugin (versions up to and including 0.4) allows authenticated attackers with Administrator-level access to persist arbitrary JavaScript payloads via the 'replacement' parameter, which subsequently execute in the browsers of any user visiting an affected page. Reported by Wordfence, the root cause is insufficient input sanitization and output escaping in word-replacer.php at multiple code locations (lines 191, 230, 339, 343). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Word Replacer plugin (vendor: takien, CPE: cpe:2.3:a:takien:word_replacer:*:*:*:*:*:*:*:*) is a WordPress plugin that replaces words or phrases in page/post content with user-defined substitutions. The vulnerability arises in the plugin's PHP code (word-replacer.php) at multiple output-rendering locations - specifically lines 191, 230, 339, and 343 in both the 0.4 tag and current trunk - where the 'replacement' parameter is neither sanitized on input nor properly escaped on output. CWE-20 (Improper Input Validation) is the assigned root cause class, though the failure is more precisely a combined input sanitization and output escaping gap typical of stored XSS. Because WordPress renders saved replacement values into page HTML at runtime, any injected script is stored server-side and delivered to all subsequent page visitors, giving this vulnerability a Changed scope (S:C) per the CVSS vector.

RemediationAI

No vendor-released patch has been identified at time of analysis - references point exclusively to the 0.4 tag and trunk code with no indication of a fixed release. The primary recommended action is to deactivate and remove the Word Replacer plugin immediately until a patched version is published; this eliminates the attack surface entirely with no functional trade-off beyond losing the word-replacement feature. As a compensating control if the plugin cannot be removed, restrict WordPress Administrator account access to the minimum necessary number of trusted users and enforce strong multi-factor authentication on all admin accounts - this raises the bar for the PR:H prerequisite significantly. Additionally, deploying a Web Application Firewall (WAF) such as Wordfence's own firewall can detect and block stored XSS injection attempts targeting plugin parameters, though WAF rules may not cover all bypass variants. Monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/word-replacer/) and the Wordfence advisory for patch announcements.