CVE-2026-66584
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List versions up to 3.19.16. Allows injecting malicious script into the page.
Risk Assessment
Risk of session theft or unauthorized actions on behalf of users.
Recommendation
Update 12 Step Meeting List to the latest version that includes the fix.
Other vulnerabilities in 12 Step Meeting List
See all- CVE-2026-39570Medium
The WordPress plugin 12 Step Meeting List (12-step-meeting-list) by AA Web Servant has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.19.9.
- CVE-2026-39569Medium
The 12 Step Meeting List plugin for WordPress up to version 3.19.9 lacks authorization, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to features.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.