CVE-2026-59553

HighCVSS 7.1

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.

Risk Assessment

An attacker can steal session data, modify page content, or conduct phishing attacks on users.

Recommendation

Update the Product Feed Manager plugin to the latest version. Use input validation and Content-Security-Policy headers.

Other vulnerabilities in Product Feed Manager

CVE-2026-66580High
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS