WordPress Plugin Vulnerabilities

Dictionary <= 1.0 - Reflected XSS via Multiple Parameters

Description

The plugin does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
dictionary
No known fix

References

CVE
CVE-2025-15697

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Hassan Khan Yusufzai - Splint3r7
Submitter
Hassan Khan Yusufzai - Splint3r7
Submitter website
https://hassankhanyusufzai.com
Submitter twitter
Splint3r7
Verified
Yes
WPVDB ID
b0d12b0d-4717-4854-8911-2a0e60eed515

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2023-04-21
Title
Live Chat by Formilla < 1.3.1 - Admin+ Stored XSS
Published
2024-10-14
Title
MAS Elementor < 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-10-15
Title
GoStore < 1.6.4 - Reflected Cross-Site Scripting
Published
2024-03-26
Title
Email Subscribers & Newsletters < 5.7.12 - Reflected Cross-Site Scripting via campaign_id
Published
2018-12-21
Title
WooCommerce <= 3.5.0 - Authenticated Stored XSS