OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-88792

HIGH · CVSS 8.8 EPSS 0.51%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Dictionary WordPress plugin prior to version 1.0 is vulnerable due to a lack of authorization, sanitization, and escaping, enabling unauthenticated users to inject arbitrary web scripts into dictionary entries. This vulnerability can lead to cross-site scripting (XSS) attacks, compromising the security of users who view the affected entries. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential risks.

CVE
CVE-2026-88792
Severity
HIGH
CVSS
8.8
EPSS
0.51%
WordPress

Original NVD Description

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.