CVE Catalog
CVE-2026-66440
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.25%
16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor versions up to 3.5.7.
Risk Assessment
An attacker can inject malicious script that executes in the admin's browser, potentially leading to session theft or admin panel takeover.
Recommendation
Update the WPIDE plugin to the latest available version that includes the fix.
Other vulnerabilities in WPIDE – File Manager & Code Editor
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS