CVE-2026-3620 Overview
CVE-2026-3620 is a Stored Cross-Site Scripting (XSS) vulnerability in the Word Replacer plugin for WordPress, affecting all versions up to and including 0.4. The flaw exists in the handling of the replacement parameter, which lacks sufficient input sanitization and output escaping [CWE-20]. Authenticated attackers with Administrator-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any user who visits an affected page, enabling session theft, content manipulation, or redirection to malicious resources.
Critical Impact
Authenticated administrators can persist arbitrary JavaScript inside WordPress pages, executing in every visitor's browser session.
Affected Products
- WordPress Word Replacer plugin versions up to and including 0.4
- WordPress sites running the vulnerable plugin trunk branch
- Any WordPress deployment with the Word Replacer plugin installed and active
Discovery Timeline
- 2026-06-02 - CVE-2026-3620 published to the National Vulnerability Database
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-3620
Vulnerability Analysis
The Word Replacer plugin allows administrators to configure word substitutions applied to WordPress page content. The plugin stores user-supplied replacement values and renders them back into pages without proper sanitization on input or escaping on output. This combination produces a stored XSS condition classified under [CWE-20] Improper Input Validation.
Because the payload is persisted in the WordPress database, the script executes every time any user — including unauthenticated visitors — loads a page where the substitution rule applies. The Scope:Changed component of the vulnerability reflects that an administrator's stored input can affect the browser context of unrelated users.
Exploitation requires Administrator-level authentication, which limits the realistic attacker profile to malicious insiders, compromised admin accounts, or scenarios where multiple administrators share a site with differing trust levels.
Root Cause
The root cause is missing sanitization of the replacement form parameter on write and missing output escaping when the substitution is rendered into page HTML. Affected code paths are referenced at lines 191, 230, 339, and 343 of word-replacer.php in both the tagged 0.4 release and the trunk branch. See the WordPress Plugin Code Snippet for the specific call sites.
Attack Vector
An attacker with Administrator privileges submits a word replacement rule whose replacement value contains JavaScript markup such as a <script> block or an event-handler attribute on an HTML tag. The plugin stores the value as-is. When WordPress renders any page processed by the plugin's replacement filter, the malicious markup is injected into the response body and executes in the visitor's browser. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-3620
Indicators of Compromise
- Word Replacer plugin configuration entries containing <script>, onerror=, onload=, or javascript: substrings in the replacement field.
- Outbound requests from site visitors to unfamiliar domains immediately after page load on pages where the plugin filter applies.
- WordPress wp_options or plugin-specific table rows storing replacement rules with HTML or JavaScript syntax.
- Unexpected administrator account activity preceding the addition or modification of replacement rules.
Detection Strategies
- Audit the Word Replacer plugin's stored rules and flag any replacement value containing HTML tags or JavaScript event handlers.
- Inspect rendered page HTML for inline scripts that do not originate from the theme or known plugins.
- Review WordPress audit logs for update_option or plugin settings save events tied to the Word Replacer plugin.
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin configuration changes and administrator logins.
- Monitor Content Security Policy (CSP) violation reports for inline script execution on public pages.
- Alert on changes to administrator-level user accounts or privilege grants on WordPress installations.
How to Mitigate CVE-2026-3620
Immediate Actions Required
- Deactivate the Word Replacer plugin until a patched version is released, since all versions through 0.4 are vulnerable.
- Review and remove any existing replacement rules that contain HTML tags, script blocks, or event-handler attributes.
- Rotate credentials for all Administrator-level WordPress accounts and enforce multi-factor authentication.
- Apply principle of least privilege by reducing the number of users with Administrator role.
Patch Information
No fixed version is identified in the published CVE record at the time of writing. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for an updated release that introduces sanitization and output escaping on the replacement parameter.
Workarounds
- Remove the Word Replacer plugin from production WordPress sites until a vendor patch is available.
- Deploy a web application firewall rule that blocks HTML or JavaScript syntax in plugin configuration POST requests.
- Implement a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
- Restrict administrator dashboard access to a trusted IP allowlist.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate word-replacer
wp plugin delete word-replacer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
