CVE-2026-66639

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in WPZOOM Forms – Contact Form Plugin for Gutenberg in versions up to 2.0.4. A user with Contributor role can inject malicious script.

Risk Assessment

Possibility of executing scripts in the victim's browser, which can lead to data theft or session hijacking.

Recommendation

Update the plugin to the latest version that includes the security fix.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.