CVE-2026-66667

HighCVSS 7.1

Published: 18/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in Templately versions up to 3.7.1. An attacker can inject a malicious script that executes in the victim's browser.

Risk Assessment

Potential session theft, account takeover, or malware distribution.

Recommendation

Update Templately to a version that includes the fix.

Other vulnerabilities in Templately

CVE-2026-18438High
The Templately plugin for WordPress (up to and including version 3.7.1) contains a Remote Code Execution (RCE) vulnerability in the fetch_remote_file function. The issue stems from a filename validation/destination mismatch — file type is validated against the Content-Disposition header, while the actual write path is derived from the URL, allowing a file with a .php extension to be written. An attacker with contributor-level access can bypass the unfiltered_upload capability gate and execute code on the server.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS