CVE-2026-88792

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

  • Published Sep 17, 2026
  • CVSS 8.8 high
  • 0.5% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-88792 at the National Vulnerability Database