Executive brief
The Dictionary WordPress plugin fails to properly sanitize user input in several publicly accessible scripts, allowing attackers to inject malicious JavaScript code. An attacker can trick users into clicking a crafted link to execute arbitrary JavaScript in their browser, potentially stealing session cookies, account credentials, or performing unauthorized actions on their behalf.
Technical details
This is a Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in the Dictionary WordPress plugin through version 1.0. The vulnerable scripts do not escape or validate user-supplied input before echoing it back in HTTP responses. The attack is unauthenticated and requires no special network access—an attacker can craft a malicious URL containing JavaScript payloads in multiple parameters and induce users to visit it. When a victim clicks the link, the JavaScript executes in their browser under the context of the WordPress site. No patch is currently available according to the advisory.
Affected products
- Dictionary Dictionary through 1.0
Timeline
- 2025-09-15: disclosed
- 2025-09-17: advisory: NVD published