Skip to main content

Word Replacer

1 CVEs product

Monthly

CVE-2026-3620 Jun 02, 07:48 MEDIUM This Month

Stored Cross-Site Scripting in the Word Replacer WordPress plugin (versions up to and including 0.4) allows authenticated attackers with Administrator-level access to persist arbitrary JavaScript payloads via the 'replacement' parameter, which subsequently execute in the browsers of any user visiting an affected page. Reported by Wordfence, the root cause is insufficient input sanitization and output escaping in word-replacer.php at multiple code locations (lines 191, 230, 339, 343). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

WordPress XSS Wordpress Plugin Word Replacer
NVD
CVSS 3.1
4.4
EPSS
0.1%
EPSS 0% CVSS 4.4
MEDIUM This Month

Stored Cross-Site Scripting in the Word Replacer WordPress plugin (versions up to and including 0.4) allows authenticated attackers with Administrator-level access to persist arbitrary JavaScript payloads via the 'replacement' parameter, which subsequently execute in the browsers of any user visiting an affected page. Reported by Wordfence, the root cause is insufficient input sanitization and output escaping in word-replacer.php at multiple code locations (lines 191, 230, 339, 343). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

WordPress XSS Wordpress Plugin +1
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy