What is CVE-2026-66637?
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Featured Video Plus plugin up to version 2.3.3, exploitable by users with the Contributor role. This could allow malicious scripts to execute in the browsers of higher-privileged users. Updating the plugin to the latest version is recommended.
Azərbaycanca: Featured Video Plus plagininin 2.3.3-ə qədər versiyalarında 'Contributor' rolundakı istifadəçi tərəfindən icra edilə bilən Saxlanılmayan (Stored) Cross-Site Scripting (XSS) zəifliyi aşkarlanıb. Bu, zərərli skriptin yüksək imtiyazlı istifadəçilərin brauzerində işə düşməsinə səbəb ola bilər. Plagini ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which user role can exploit the CVE-2026-66637 vulnerability in the Featured Video Plus plugin?
This vulnerability can be exploited by a user with the 'Contributor' role.
What is the impact of CVE-2026-66637 and how to mitigate it?
The vulnerability is a Stored Cross-Site Scripting (XSS) that could allow malicious scripts to execute in the browsers of higher-privileged users. Updating the plugin to the latest version is recommended.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.