Executive brief
GenieWords is a WordPress plugin that lacks proper authorization checks on some REST API and AJAX endpoints. An unauthenticated attacker can exploit this to modify the plugin's configuration and inject malicious scripts that execute on every page visitors see, potentially stealing credentials, redirecting users to phishing sites, or compromising website integrity.
Technical details
The vulnerability involves missing authorization checks on REST API and AJAX actions combined with improper output encoding of stored configuration values. This allows unauthenticated users to write arbitrary data to plugin settings and inject XSS payloads that are decoded and rendered on the front-end. The vulnerability affects GenieWords versions 1.5.27 through 1.5.34. Attack requires no authentication and is network-reachable. An attacker can achieve persistent cross-site scripting affecting all website visitors. A patch status is not explicitly mentioned in available references.
Affected products
- GenieWords GenieWords 1.5.27 to 1.5.34
Timeline
- 2026-09-10: disclosed
- 2026-09-13: advisory