CVE-2026-3620 identifies a stored cross-site scripting vulnerability in the Word Replacer WordPress plugin by takien. The issue stems from improper input validation (CWE-20) of the 'replacement' parameter, which allows authenticated users with Administrator-level privileges or higher to inject arbitrary web scripts. These scripts persist in the application and execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 0.4. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker with Administrator-level access can exploit this vulnerability to inject persistent malicious scripts into pages, potentially leading to session hijacking, defacement, or other client-side attacks against users who visit the compromised pages. The confidentiality and integrity of user interactions with the affected site may be partially compromised. The attack requires high privileges and does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and consider disabling or removing the Word Replacer plugin if possible. Monitor for updates from the vendor or plugin maintainers regarding patches or mitigations.