CVE-2026-66663
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.
Risk Assessment
An attacker can steal user data such as sessions or cookies, potentially leading to account takeover or malware distribution.
Recommendation
Update the WP Data Access plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in WP Data Access
See all- CVE-2026-66595Medium
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
- CVE-2026-42665Critical
There is an unauthenticated SQL Injection vulnerability in WP Data Access versions <= 5.5.70.
- CVE-2026-73344Medium
Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.