WordPress Plugin Vulnerabilities

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

Description

The plugin does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Proof of Concept

Affects Plugins

Plugin icon
geniewords
No known fix

References

CVE
CVE-2026-74933

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
23dc45bb-e7b6-4cae-81ce-2c6394afb454

Timeline

Publicly Published
2026-09-10 (about 3 days ago)
Added
2026-09-10 (about 3 days ago)
Last Updated
2026-09-11 (about 1 day ago)

Other

Published
Title
Published
2023-11-03
Title
Gift Up Gift Cards for WordPress and WooCommerce < 2.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2022-08-31
Title
Image Hover Effects Ultimate < 9.8.0 - Authenticated Stored XSS
Published
2024-03-15
Title
Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS
Published
2025-05-13
Title
FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS
Published
2023-09-27
Title
Font Awesome Integration <= 5.0 - Contributor+ Stored Cross-Site Scripting