CVE-2026-66646 MEDIUM

CVE-2026-66646: WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Vendor Mythemeshop

Product WP Tab Widget

Weakness CWE-79 · XSS

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Tab Widget versions up to 1.2.11 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into tab widget content. When other users view the affected page, the script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on their behalf. The vulnerability requires user interaction to trigger.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that execute when other users view pages containing the affected widget.

Potential impact on your site

04Site Impact

Authenticated users can inject code affecting all site visitors; attackers could steal admin sessions or deface content.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account and the victim must view a page with the malicious widget.

Key dates

06Disclosure timeline

August 18, 2026 CVE published

August 18, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66646 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities