Vulnerability · Published Sep 13, 2026 · Assigned by WPScan
CVE-2026-74933GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
High 8.8
In plain English
A high-severity missing authorization in GenieWords from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 56.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | GenieWords | 1.5.27 – through 1.5.34 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/ exploit, vdb-entry, technical-description