๐Ÿ›ก๏ธ CVE-2026-6395
๐ŸŸก CVSS 6.1 โ€” Medium โœ… No Known Exploit CWE-352 NVD
6.1
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a