{"id":"CVE-2026-88792","state":"PUBLISHED","title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","publishedAt":"2026-09-17T06:00:11.810Z","updatedAt":"2026-09-17T12:28:14.877Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Dictionary"],"affected":[{"vendor":"Unknown","product":"Dictionary","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/88xxx/CVE-2026-88792.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-88792","state":"PUBLISHED","datePublished":"2026-09-17T06:00:11.810Z","dateUpdated":"2026-09-17T12:28:14.877Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-09-10T08:08:20.286Z"},"containers":{"cna":{"title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","descriptions":[{"lang":"en","value":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry."}],"affected":[{"vendor":"Unknown","product":"Dictionary","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-17T06:00:11.810Z"},"credits":[{"lang":"en","value":"Pablo González Pérez","type":"finder"},{"lang":"en","value":"Francisco José Ramírez Vicente","type":"finder"},{"lang":"en","value":"and Iñigo Sánchez Enciso","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T12:12:31.979583Z","id":"CVE-2026-88792","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T12:28:14.877Z"}}]}}}