Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

GenieWords plugin lets anyone change settings and add scripts

CVE-2026-74933 · published 1 month ago
Summary

The GenieWords add-on for WordPress (versions 1.5.27 through 1.5.34) does not check who is making certain web requests, so anyone can send a request and alter the plugin's configuration. This can be used to insert malicious code that runs on every page of your site. Update the plugin to a newer version or remove it until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
unknown geniewords <= 1.5.34
Original advisory text
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthent...
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Sep 2026
Updated4 Nov 2026
First seen13 Sep 2026
Sources
CVE-2026-74933 · NVD
CVE-2026-74933 · MITRE
Track software like this
Free during beta