CVE-2026-66621: WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation requires user interaction, as indicated by the UI:R vector.
Which installations are affected, and is a fixed version identified?
Installations running Ultimate Dashboard version 3.11.2 or earlier are affected according to the available information. The data does not identify a fixed version or provide a workaround for deployments that cannot patch immediately.
Can I determine whether this vulnerability has already been exploited?
The supplied information does not describe the vulnerable input, endpoint, or any log indicators. As a result, it cannot be used to determine from logs whether exploitation has already occurred.