CVE-2026-74933 — GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

CVE-2026-74933

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite PUBLISHED

Description (CNA)

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

Affected (CNA)

Vendor / product	Versions
Unknown / GenieWords	affected 1.5.27 through 1.5.34

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.