CVE-2026-66683 MEDIUM

CVE-2026-66683: WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Vendor Wp Zone

Product Custom CSS and JavaScript

Weakness CWE-201

Published August 6, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Custom CSS and JavaScript versions up to 2.0.16 leak sensitive information in outbound data. An unauthenticated attacker on the network can intercept or observe this data without user interaction. The plugin exposes details that should remain confidential, potentially revealing site configuration or user information to passive observers.

What an attacker can do

03Attacker Capabilities

Intercept or observe sensitive information sent by the plugin in network traffic.

Potential impact on your site

04Site Impact

Sensitive site or user data may be exposed to network-level eavesdropping if HTTPS is not enforced.

Conditions required to exploit

05Prerequisites

Network access to observe outbound traffic; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published

August 6, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66683 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities

Identifiers

CVE CVE-2026-66683

CWE CWE-201

CVSS 5.3 / MEDIUM

Affected versions