The Dictionary WordPress plugin is vulnerable to unauthenticated stored Cross-Site Scripting, which could allow attackers to execute malicious scripts in the context of a victim's browser session.

This is a stored Cross-Site Scripting (CWE-79) vulnerability that occurs because the plugin lacks proper authorization, sanitization, and escaping mechanisms when processing dictionary entries. An unauthenticated attacker can inject arbitrary web scripts that execute whenever a user views the compromised entry.

The exploitation of this vulnerability poses a significant risk to user session integrity and application security. With a CVSS score of 8.8, this flaw allows attackers to steal session cookies, redirect users to malicious domains, or perform unauthorized actions on behalf of authenticated administrators, potentially leading to a full site compromise.

Immediate Action: Since no patch is currently available, administrators should immediately deactivate and remove the Dictionary plugin from their WordPress environment until a secure version is released.

Proactive Monitoring: Security teams should audit WordPress user activity logs and monitor for unusual script injections or modifications within the dictionary database tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect incoming traffic and block malicious payloads directed at the dictionary entry submission endpoints.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the lack of a verified patch, immediate removal of the affected software is the only reliable method to mitigate risk. Organizations should prioritize removing the plugin and evaluating alternative solutions that adhere to modern secure coding practices.