Skip to content
Sign in
7.1 High

CVE-2025-15697 The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of…

Description

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.

Affected products and versions

Product Affected versions Fixed in
Dictionary 1.0 earliest → 1.0 No fix stated

Other CVEs of Dictionary

The 2 CVEs of Dictionary →
CVE-2026-88792 The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding… 8.8 High
Track this CVE