The Word 2 Cash plugin for WordPress allows a user to configure currency settings via a settings page. In versions 0.9.2 and earlier, the plugin fails to verify a nonce on the settings save handler, does not sanitize the incoming w2c-definitions POST parameter before storing it with update_option, and later outputs the stored value unescaped inside a <textarea>. As a result an attacker can send a forged POST request to the settings page and cause arbitrary JavaScript to be persisted in the database. When a privileged administrator later visits the same settings page, that JavaScript runs in the context of the admin, enabling full site compromise.

The vulnerability affects any WordPress site that has the Word 2 Cash plugin installed in a version up to and including 0.9.2. The issue is specific to this plugin’s settings handler; other core WordPress components are not impacted.

The CVSS score of 6.1 indicates a moderate risk, however the attack requires only a crafted web request and does not need any special credentials. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, yet the static CSRF/XSS flaw is commonly exploitable in practice. Because the attacker can inject code that will execute whenever a legitimate administrator views the settings page, the risk includes full privilege escalation and site defacement. Administrators should promptly patch or disable the plugin to mitigate the threat.