{"api_version":"1","generated_at":"2026-09-17T07:51:17+00:00","cve":"CVE-2026-88792","urls":{"html":"https://cve.report/CVE-2026-88792","api":"https://cve.report/api/cve/CVE-2026-88792.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-88792","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-88792"},"summary":{"title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","description":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-09-17 06:16:51","updated_at":"2026-09-17 06:16:51"},"problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/","name":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88792","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88792","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Dictionary","version":"affected 1.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Pablo González Pérez","lang":"en"},{"source":"CNA","value":"Francisco José Ramírez Vicente","lang":"en"},{"source":"CNA","value":"and Iñigo Sánchez Enciso","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Dictionary","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Pablo González Pérez"},{"lang":"en","type":"finder","value":"Francisco José Ramírez Vicente"},{"lang":"en","type":"finder","value":"and Iñigo Sánchez Enciso"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry."}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-17T06:00:11.810Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/"}],"source":{"discovery":"EXTERNAL"},"title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-88792","datePublished":"2026-09-17T06:00:11.810Z","dateReserved":"2026-09-10T08:08:20.286Z","dateUpdated":"2026-09-17T06:00:11.810Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 06:16:51","lastModifiedDate":"2026-09-17 06:16:51","problem_types":["CWE-79 Cross-Site Scripting (XSS)"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"88792","Ordinal":"1","Title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictio","CVE":"CVE-2026-88792","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"88792","Ordinal":"1","NoteData":"The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.","Type":"Description","Title":"Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictio"}]}}}