CVE-2025-15697
Dictionary <= 1.0 - Reflected XSS via Multiple Parameters
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
| Vendor | unknown |
| Product | dictionary |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown dictionary
Be the first to know when new high vulnerabilities affecting unknown dictionary are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Dictionary
0 ≤ 1.0
References
Credits
Hassan Khan Yusufzai - Splint3r7 WPScan