CVE-2026-66456

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross Site Scripting (XSS) vulnerability in Profile Extra Fields by BestWebSoft versions up to 1.3.4, exploitable by a user with Subscriber role.

An attacker can inject malicious script, potentially leading to data theft or session hijacking.

Update the Profile Extra Fields by BestWebSoft plugin to the latest patched version.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.