Executive brief
The Word Replacer plugin for WordPress, which allows site owners to automatically swap specific words or phrases in their content, contains a security flaw. An authorized administrator could potentially inject malicious scripts into the website's pages. If exploited, these scripts would run in the browsers of any visitor who views the affected pages, potentially leading to unauthorized actions or data theft.
Technical details
The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'replacement' parameter. This vulnerability exists in all versions up to and including 0.4. An authenticated attacker with Administrator-level privileges can inject arbitrary web scripts into the database. These scripts are then executed in the context of a user's browser session whenever they visit a page where the replacement occurs. While the attack requires high privileges, the impact is increased by the fact that the script can execute in the context of other users, including other administrators.
Affected products
- WordPress Word Replacer up to, and including, 0.4
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
References
- https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/tags/0.4/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php
- https://plugins.trac.wordpress.org/browser/word-replacer/trunk/word-replacer.php