CVE-2026-66667: WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/templatelyto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Which deployments are exposed and what does exploitation require?
Sites using Templately version 3.7.1 or earlier are affected. Exploitation can be attempted remotely without authentication, but it requires user interaction.
Is a default Templately configuration known to be affected?
The provided information does not state whether the vulnerable behavior is enabled in a default configuration or identify a specific feature or endpoint involved.
What can be done if an update is not immediately available?
The supplied data identifies affected versions but provides no workaround, mitigation, detection method, or fixed version. Until update guidance is available, prioritize reviewing use of Templately on exposed WordPress sites and monitor the vendor or referenced advisory for remediation details.