CVE-2026-66646

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross Site Scripting (XSS) vulnerability in WP Tab Widget versions up to 1.2.11. The attack requires contributor-level privileges.

A contributor can inject malicious scripts, potentially leading to session theft, account takeover, or other attacks on users.

Update the WP Tab Widget plugin to the latest version that includes the fix.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.