Unauthenticated Stored XSS in WordPress Dictionary Plugin

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-88792 is a critical stored cross-site scripting (XSS) vulnerability in the Dictionary WordPress plugin that allows unauthenticated attackers to inject and persist arbitrary JavaScript code through dictionary entries. The vulnerability exists because the plugin fails to implement three essential security controls: authorization checks, input sanitization, and output escaping. Any visitor to a WordPress site running this plugin can inject malicious scripts that execute in the browsers of legitimate users viewing those entries, making this a high-impact threat (CVSS 8.8). Organizations using this plugin are at immediate risk of session hijacking, credential theft, malware distribution, and defacement.

Casky's 323 matched skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - specifically adversary capability assessment). Claude's extended reasoning identifies the CWE-79 injection pattern across multiple attack vectors: initial reconnaissance of the Dictionary plugin presence, probing for authorization weaknesses, crafting polyglot payloads that bypass weak sanitization, and observing execution behavior. Practitioners using Casky would see findings highlighting unauthorized entry creation attempts, script tag patterns in dictionary content fields, absence of Content Security Policy headers, and post-injection user session anomalies—enabling rapid identification and remediation before persistent XSS reaches production environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88792.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-88792

Casky has 323 skills that investigate the attack patterns behind CVE-2026-88792. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn