CVE-2026-66643

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross Site Scripting (XSS) vulnerability in Wufoo Shortcode in versions up to 1.55. A user with Contributor role can inject malicious script.

An attacker can execute scripts in the victim's browser context, which can lead to data theft or session hijacking.

Update the plugin to the latest version that includes the security fix.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.