CVE-2026-66698
WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
CVSS score
7.1
EPSS probability
%0.3
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.8
CVE-2026-106599
WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
BF
Patch status unknown
7.1
CVE-2026-105874
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
BF
Patch status unknown
8.8
CVE-2026-96837
WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability
BF
Patch status unknownEPSS %1
8.8
CVE-2026-87741
ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
BF
Patch status unknownEPSS %0
7.5
CVE-2026-80433
WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
BF
Patch status unknownEPSS %0
7.2
CVE-2026-32553
WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability
BF
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-66698"