WordPress GenieWords plugin 1.5.27-1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite vulnerability

Unauthenticated Stored XSS and Configuration Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin GenieWords versions 1.5.27-1.5.34...

CVE-2026-74933

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

EUVD-2026-77084

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-74933

The GenieWords WordPress plugin, versions 1.5.27 through 1.5.34 , is affected by missing authorization checks on several of its REST API and AJAX actions. Because the plugin decodes stored values before outputting them, an unauthenticated attacker can overwrite the plugin's configuration and inje...

CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

PT-2026-90961

Name of the Vulnerable Software and Affected Versions GenieWords versions 1.5.27 through 1.5.34 Description Lack of authorization checks on certain REST API and AJAX actions allows unauthenticated users to overwrite plugin configuration. Additionally, the software decodes stored values before...

CVE-2026-74933: Missing Authorization

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...