Security Alert Summary
The Dictionary WordPress plugin (through version 1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability. The plugin does not escape user input before reflecting it in responses from several directly accessible scripts, which allows unauthenticated attackers to craft requests that trigger script execution in a victim’s browser.
CVE Details
- CVE ID: CVE-2025-15697
- Affected component: Dictionary WordPress plugin
- Affected versions: through 1.0
- Published: September 17, 2026 6:16:50 AM UTC
- Last modified: September 17, 2026 1:16:41 PM UTC
- CVSS v3.1: Base Score 7.1, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Authentication / privileges / user interaction: No privileges required (NONE); user interaction required (REQUIRED)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: Low
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
According to the advisory, the Dictionary plugin through version 1.0 fails to escape user-supplied input before reflecting it back in responses generated by several directly accessible scripts. This lack of output encoding allows an attacker to craft a request that includes executable script content, which will be returned in the response and executed in the context of a victim’s browser when they follow the crafted link or submit the crafted request.
The vulnerability is a reflected XSS issue: it requires the attacker to induce a user to submit a specially crafted request and does not require authentication. The advisory does not name specific function names or REST endpoints; it describes the issue as present in several directly accessible scripts.
Impact is limited according to the provided metrics: confidentiality, integrity, and availability impacts are rated as low. In practical terms, an exploited reflected XSS can allow execution of attacker-controlled script in the victim’s browser, constrained by the attack vector and user interaction requirements listed in the CVSS data.
How This Could Impact Your Website
On a multi-user WordPress site, an external attacker could craft a URL or form submission that, when opened or submitted by an internal staff member, external contractor, or other contributor, executes script in that user’s browser. Possible real-world consequences include exposure of information visible to the victim account (such as displayed email addresses), session token theft in some cases, or actions performed in the context of the victim’s browser session.
For example, a site owner might publish a link in a shared channel that an external contractor clicks; if that request triggers the reflected XSS, the contractor’s browser could execute the injected script. This can increase the risk of targeted phishing or social engineering that leverages information obtained via the injection. The CVSS impact ratings indicate the overall impact is limited (low) rather than site-wide compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles with editing privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, particularly unexpected requests that include unusual query parameters or payloads.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
