Atomic Edge analysis of CVE-2026-6395 (metadata-based):
This vulnerability is a chain of Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in the Word 2 Cash plugin for WordPress, up to version 0.9.2. The flaw affects the plugin’s settings handler function w2c_admin(). An unauthenticated attacker can trick a logged-in administrator into submitting a crafted request, which silently saves arbitrary JavaScript into the plugin’s settings. The script then executes automatically in the WordPress admin panel whenever the settings page is loaded. The CVSS score is 6.1 (Medium), reflecting the requirement for user interaction and the limited scope change (confidentiality and integrity impacts within the admin panel).
The root cause is the complete absence of nonce verification on the settings save handler (w2c_admin()), as confirmed by the CVE description. Additionally, the plugin does not sanitize the w2c-definitions POST parameter before storing it via update_option(), nor does it escape the stored value before echoing it inside a ), the browser executes the script when the admin views the plugin’s settings page. An attacker can host a form that auto-submits via JavaScript, targeting an authenticated administrator. If the administrator clicks a link or visits a page containing the form, the attacker-controlled payload is saved.
The fix requires three changes in the plugin’s code. First, add a nonce check using wp_verify_nonce() in the w2c_admin() function before processing the saved data, with a corresponding wp_nonce_field() in the settings form. Second, sanitize the w2c-definitions input before storage using a function like sanitize_text_field() or wp_kses_post() depending on the expected content. Third, escape the stored value when outputting it in the