CVE-2026-66641: WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.8
Event History
Frequently Asked Questions
What level of access does an attacker need?
The affected product is WordPress Video Conferencing with Zoom through version 4.6.8. The issue is identified as contributor XSS, so exploitation requires Contributor-level access.
What are the practical exploitation conditions?
The CVSS vector indicates network reachability, low attack complexity, low privileges, and required user interaction. Exploitation therefore involves a low-privileged authenticated user delivering content that another user must interact with.
What can be done while a patch is unavailable?
The provided data identifies affected versions through 4.6.8 but does not identify a fixed version or a workaround. If patching cannot be completed immediately, restrict Contributor access to trusted users and review content submitted by Contributors before it is viewed by higher-privileged users.