CVE-2026-66599
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
CVSS score
7.1
EPSS probability
%0.3
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
10.0
CVE-2026-82222
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
LW
Patch status unknown Public Exploits:11EPSS %2
9.8
CVE-2026-97283
WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability
LW
Patch status unknownEPSS %0
9.8
CVE-2026-95606
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
LW
Patch status unknownEPSS %0
9.1
CVE-2026-97196
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
LW
Patch status unknownEPSS %0
8.5
CVE-2026-97287
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
LW
Patch status unknownEPSS %0
7.5
CVE-2026-96333
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
LW
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-66599"