Is CVE-2026-6395 actively exploited?

No active exploitation of CVE-2026-6395 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6395 be exploited remotely?

Yes. CVE-2026-6395 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-6395?

CVE-2026-6395 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-6395

MEDIUM

CVE-2026-6395

CWE-352Published: May 20, 2026· Updated: May 20, 2026

6.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.8th

Official Description

The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.

NVD Source

Technical Analysis

CVE-2026-6395 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.