CVE-2026-74933 PUBLISHED

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

Assigner: WPScan
Reserved: 17.08.2026 Published: 13.09.2026 Updated: 14.09.2026

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Unknown
Product	GenieWords
Versions	Default: unknown affected from 1.5.27 to 1.5.34 (incl.)

Credits

Pablo González Pérez finder
Francisco José Ramírez Vicente finder
Iñigo Sánchez Enciso finder
WPScan coordinator

References

https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/

Problem Types

CWE-862 Missing Authorization CWE
CWE-79 Cross-Site Scripting (XSS) CWE