CVE-2026-66641

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.

Risk Assessment

Possibility of executing scripts in the victim's browser, which can lead to data theft or session hijacking.

Recommendation

Update the plugin to the latest version that includes the security fix.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.