CVE-2026-3620: Word Replacer Plugin WordPress Stored XSS Vulnerability

Technical summary

CVE-2026-3620 is a Stored XSS vulnerability in the Word Replacer WordPress plugin caused by insufficient sanitization of the 'replacement' parameter and lack of proper output escaping. The flaw allows high-privileged authenticated users to inject arbitrary JavaScript that persists server-side and executes in the browser context of subsequent visitors. The vulnerability is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 4.4 (MEDIUM severity). The attack vector is network-based, though it requires high privilege escalation (administrator role) and human interaction is not necessary for payload execution once injected.

Business impact

While this vulnerability requires administrator credentials to exploit, it represents a significant insider threat and privilege-abuse risk. Malicious administrators or compromised admin accounts can deface site content, redirect visitors to phishing sites, inject malware, or capture sensitive user data. For WordPress sites with multiple administrators or shared hosting environments, the risk compounds. The reputational damage and potential legal liability from serving malicious content to end users should not be underestimated, particularly for e-commerce or financial services sites.

Affected systems

All versions of the Word Replacer plugin for WordPress up to and including version 0.4 are affected. The vulnerability impacts WordPress installations that have this plugin installed and activated, regardless of WordPress core version. No other products or vendors are mentioned in available CVE data. Exposure is limited to sites where the plugin is present; however, administrators should verify their installed version against the vendor advisory to confirm patch availability.

Exploitability

Exploitation requires authentication as a WordPress administrator or higher-privileged role, which significantly restricts the attack surface. No public exploit code is documented in the KEV catalog (this CVE is not listed as known exploited in the wild). However, the barrier to entry is lower in environments with multiple admins, delegated admin privileges, or where admin credentials have been compromised through phishing or weak password practices. Once injected, the payload executes automatically without requiring further user interaction, making detection and remediation complex.

Remediation

Update the Word Replacer plugin to a patched version released after 0.4. Site administrators should immediately audit plugin versions across their WordPress installations and prioritize updates. Until patching is possible, consider disabling the Word Replacer plugin if it is not mission-critical. Additionally, audit WordPress administrator accounts for unauthorized access and review recent plugin settings changes in the WordPress audit logs to detect any malicious injections already present.

Patch guidance

Check the official Word Replacer plugin repository on WordPress.org or the vendor's website for version 0.5 or later, which should address this vulnerability. Verify the patch details against the vendor advisory before deployment. Most WordPress sites can update plugins directly through the WordPress admin dashboard (Plugins → Installed Plugins → Update). Test the update in a staging environment first to ensure compatibility with your other plugins and theme. After updating, verify that the Word Replacer functionality works as expected and that no injected content remains in your site database.

Detection guidance

Monitor WordPress audit logs and database activity for modifications to the Word Replacer plugin settings or suspicious changes to the 'replacement' parameter values. Look for unusual JavaScript or HTML in replacement text stored in the database—legitimate use cases typically involve simple text strings, not code. Use WordPress security plugins that scan for stored XSS or malicious content injection. Consider implementing a Web Application Firewall (WAF) rule to flag attempts to store script tags or event handlers in plugin parameters. Regularly audit administrator account activity and permission changes.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt attention due to its persistence (stored XSS), broad impact (affects all site visitors), and the insider-threat nature of the attack. The moderate CVSS score reflects the requirement for high-level privileges, but the reputational and operational risks of a compromised administrator injecting malicious content should not be minimized. Prioritize patching for public-facing or customer-critical WordPress sites within 30 days.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects: (1) network-based attack vector with no special network access required; (2) high privilege requirement (PR:H), significantly limiting exploitability; (3) high complexity (AC:H), meaning specific conditions or user circumstances must be present; (4) scope change (S:C), meaning the vulnerability affects resources beyond the vulnerable component; and (5) limited impact—low confidentiality and integrity impact, no availability impact. The score appropriately balances the severity of stored XSS against the privilege barrier that prevents opportunistic exploitation.

Frequently asked questions