CVE-2026-66641
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.
Risk Assessment
Possibility of executing scripts in the victim's browser, which can lead to data theft or session hijacking.
Recommendation
Update the plugin to the latest version that includes the security fix.
Other vulnerabilities in Video Conferencing with Zoom
See all- CVE-2026-103335Medium
The Video Conferencing with Zoom WordPress plugin contains an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 4.6.10.
- CVE-2026-39653Medium
The Video Conferencing with Zoom WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.6.6.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS