CVE-2026-66460

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross Site Scripting (XSS) vulnerability in AfterShip Tracking versions up to 1.18.1, exploitable by a user with Subscriber role.

An attacker can inject malicious script, potentially leading to data theft or session hijacking.

Update the AfterShip Tracking plugin to the latest patched version.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.