CVE-2026-3620 is a stored cross-site scripting vulnerability in the Word Replacer WordPress plugin caused by improper input validation (CWE-20). The issue arises from insufficient sanitization and escaping of the 'replacement' parameter, enabling authenticated administrators to inject arbitrary scripts into pages. These scripts execute in the context of users visiting the affected pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability requires high privileges (Administrator or above) and does not require user interaction beyond visiting the injected page. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, and high privileges required.

An attacker with Administrator-level access can inject persistent malicious scripts into WordPress pages via the vulnerable 'replacement' parameter. These scripts execute in the browsers of users who visit the affected pages, potentially exposing user data or performing actions with the user's privileges. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability does not allow unauthenticated exploitation and requires high privileges, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and consider disabling or removing the Word Replacer plugin if possible. Monitor for updates from the vendor or security community regarding patches or workarounds.