GenieWords CVE-2026-74933

No authentication is required - the affected REST API and AJAX endpoints lack any WordPress capability check or nonce verification, making them reachable by any unauthenticated HTTP client. The GenieWords plugin must be installed and active on the target WordPress site, running a version between 1.5.27 and 1.5.34 inclusive. For the XSS payload to execute, a site visitor (any user, including unauthenticated front-end visitors) must load a front-end page after the configuration has been overwritten - this is the UI:R interaction requirement. The stored XSS fires site-wide on every front-end page, not only on a specific page or admin panel, which maximizes victim exposure. There is no requirement for a specific WordPress version, hosting configuration, or co-installed plugin; any default WordPress install running the affected plugin version is vulnerable.

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:N/UI:R reflects the unauthenticated network-reachable write path (PR:N, AV:N, AC:L) and the requirement that a victim visit a page for XSS to fire (UI:R). The S:U (unchanged scope) designation is questionable: stored XSS by definition executes in the security context of the victim's browser rather than the server, which under standard CVSS 3.1 guidance corresponds to S:C (changed scope). This discrepancy means the published score likely understates the cross-context nature of the impact. The C:H/I:H/A:H impact ratings are aggressive; A:H is plausible only if the XSS payload disrupts site functionality or performs administrative destructive actions, which is not confirmed by the description. A publicly available exploit from WPScan and the low complexity make this a realistic opportunistic threat against unpatched sites. EPSS data was not provided; the unauthenticated, low-complexity attack surface suggests medium-to-high exploitation probability against exposed sites. No KEV confirmation, but the combination of public PoC plus unauthenticated access elevates realistic priority above raw EPSS absence would suggest.

An unauthenticated attacker sends a crafted POST request to the GenieWords REST API or AJAX endpoint - no credentials or nonce required - writing a JavaScript payload into the plugin's stored configuration. From that point, every visitor who loads any front-end page of the site triggers the stored XSS, allowing the attacker to harvest session cookies, redirect victims to phishing pages, or perform actions on behalf of any authenticated user including administrators. A public exploit from WPScan lowers the barrier to exploitation to script-kiddie level.