CVE-2026-66479: WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPComplete pluginto a version that resolves this vulnerability.Fixed in 2.9.5.7
Event History
Frequently Asked Questions
Which installations are affected?
WPComplete versions through 2.9.5.6 are affected. The provided data does not identify a fixed version.
What does an attacker need to exploit this issue?
The attack can be performed over the network with low complexity and does not require attacker authentication, but it requires user interaction. The vulnerability is described as CSRF leading to stored cross-site scripting.
What is the likely impact if exploitation succeeds?
The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. Stored XSS may affect users who later view content where the injected script is rendered.