nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-2257 CVE-2026-2257
MEDIUM
GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
Record summary
CVE-2026-2257 has a selected CVSS score of 6.4 (medium).
Description
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to Stored Cross-Site Scripting when a higher-privileged user (such as an Administrator) views the affected post's "Competitor" tab in the GetGenie sidebar.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
GetGenie – AI Content Writer with Keyword Research & SEO Tracking ToolsBrowse roxnor / GetGenie – AI Content Writer with Keyword Research & SEO Tracking ToolsDefault status: unaffected | CVE List | Through 4.3.2 | affected |
References
4plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/getgenie/tags/4.3.2/app/Api/Store.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3479838%40getgenie%2Ftrunk&old=3446466%40getgenie%2Ftrunk&sfp_email=&sfph_mail= wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7b119d-ec56-40cb-80ef-67585dadad77?source=cve