The Word Replacer WordPress plugin allows administrators to specify a replacement string through a "replacement" parameter. The plugin fails to sanitize or escape this input before storing it, enabling attackers with administrator privileges to inject arbitrary JavaScript into the site's content. When an end‑user views a page containing the injected string, the malicious script executes in their browser, potentially leading to session hijacking, defacement, or credential theft. The vulnerability is a classic input validation flaw (CWE‑20).

The flaw exists in the Word Replacer plugin developed by Takien, affecting all releases up to and including 0.4. Sites running this plugin with any of those versions are at risk if an attacker gains or already holds administrator privileges.

The CVSS score of 4.4 indicates moderate impact when the attacker is trusted with admin access. Because the exploit requires authenticated use of the Word Replacer module, it is not exploitable by unauthenticated users. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation likelihood is uncertain but the presence of stored XSS renders it a significant concern for sites with compromised administrator accounts.