The Dictionary WordPress plugin is vulnerable to unauthenticated reflected Cross-Site Scripting, which allows attackers to execute malicious scripts in the browsers of unsuspecting users.

The application fails to properly escape user-provided input before reflecting it back within script responses. This flaw permits unauthenticated attackers to conduct reflected Cross-Site Scripting (XSS) attacks by inducing users to interact with a crafted request.

Successful exploitation enables attackers to execute arbitrary JavaScript in the context of an authenticated user session, potentially leading to unauthorized actions, session hijacking, or the theft of sensitive session cookies. Given the CVSS score of 7.1, this vulnerability poses a significant risk to site integrity and user trust, as it can be leveraged to redirect users to malicious domains or manipulate content displayed on the site.

Immediate Action: Since a specific patch is currently unknown, administrators should disable or uninstall the Dictionary plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous URL parameters or unusual script-based injection patterns targeting the plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to block malicious payloads from reaching the vulnerable script parameters.

Public Exploit Available: No

This vulnerability represents a high-risk entry point for cross-site scripting attacks due to the unauthenticated nature of the flaw. Organizations currently utilizing the Dictionary plugin should immediately move to remove or disable the component until verified remediation is available to prevent potential compromise of user sessions.