Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-88792
PublishedThe Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-88792
PublishedDictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
- Source published
- 17 Sep 2026 06:00:11 UTC
- Source modified
- 17 Sep 2026 12:28:14 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.