CVE-2026-88792: Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
Published Sep 17, 2026
·Updated
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
Affected Software
1 affected component
WordPress plugin: Dictionary<=1.0
Event History
Sep 17, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker does not need to authenticate. They can add or update dictionary entries containing arbitrary web scripts.
2
When does the malicious script execute?
The stored script executes when a user views an affected dictionary entry.
3
Are default protections such as authorization or input handling effective for this feature?
No. The affected plugin lacks authorization, sanitization, and output escaping when dictionary entries are added or updated.