CVE-2026-6395
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Word 2 Cash plugin for WordPress up to version 0.9.2 is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. Lack of nonce verification, input sanitization, and output escaping allows unauthenticated attackers to forge requests on behalf of an admin and store arbitrary JavaScript payloads.
Risk Assessment
The attack can lead to arbitrary JavaScript execution in the WordPress admin panel, enabling admin account takeover and full site compromise.
Recommendation
Immediately update the Word 2 Cash plugin to the latest version or remove it if no patch is available.
Original NVD description (English source)
The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.