CVE-2026-6395 affects the Word 2 Cash plugin for WordPress, allowing unauthenticated attackers to perform CSRF attacks due to missing nonce verification in the w2c_admin() function's settings save handler. The vulnerability is exacerbated by the absence of input sanitization and output escaping for the w2c-definitions POST parameter, which is saved raw via update_option() and later echoed inside a <textarea> element. This combination permits stored XSS payloads to execute in the WordPress admin interface when the settings page is accessed by an administrator.

Successful exploitation allows an attacker to inject and store arbitrary JavaScript code that executes in the context of the WordPress admin panel. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The CVSS score is 6.1 (medium severity), reflecting the network attack vector, no privileges required, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — no official fix or vendor advisory is available at this time. Until a patch is released, administrators should avoid visiting the plugin's settings page or disable the plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.