CVE-2026-66637

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Cross Site Scripting (XSS) vulnerability in Featured Video Plus in versions up to 2.3.3. A user with Contributor role can inject malicious script.

Possibility of executing scripts in the victim's browser, which can lead to data theft or session hijacking.

Update the plugin to the latest version that includes the security fix.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.