Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-74933

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-74933

Published

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-74933

Published

GenieWords

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "GenieWords",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.5.27",
                            "lessThanOrEqual": "1.5.34"
                        }
                    ],
                    "defaultStatus": "unknown",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON