Geniewords
Monthly
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.