CVE-2026-66687

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.

A customer can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.

Update the WpBookingly plugin to a version newer than 1.3.2.

Original NVD description (English source)

Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.