CVE-2026-66479— WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
Quick assessment
Affected
Liquid Web / StellarWP WPComplete
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Liquid Web / StellarWP WPComplete 中存在跨站请求伪造（CSRF）漏洞，导致存储型跨站脚本（Stored XSS）攻击。该问题影响 WPComplete 插件：从初始版本到 2.9.5.6 版本均受此漏洞影响。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66479
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Liquid Web / StellarWP | WPComplete | 0 ~ 2.9.5.6 | - |
|
II. Public POCs for CVE-2026-66479
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66479
请登录查看更多情报信息。
Other References for CVE-2026-66479 (1)
Same Patch Batch · Liquid Web / StellarWP · 2026-10-08 · 6 CVEs total
| CVE-2026-105890 | 6.5 MEDIUM | WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) |
| CVE-2026-105888 | 5.4 MEDIUM | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-106600 | 5.3 MEDIUM | WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability |
| CVE-2026-105893 | 5.3 MEDIUM | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-105891 | 4.3 MEDIUM | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
IV. Related Vulnerabilities
Same product: WPComplete
-
CVE-2026-77820
WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored -
CVE-2026-66599
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scriptin -
CVE-2026-57661
WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Contr -
CVE-2026-42750
WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scriptin -
CVE-2025-49906
WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Contr
Same vendor: Liquid Web / StellarWP
-
CVE-2026-105893
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-105891
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-105890
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.1 -
CVE-2026-105888
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access C -
CVE-2026-106600
WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vu
Same weakness: CWE-352
-
CVE-2026-106611
WordPress Forminator plugin <= 1.57.3 - Cross Site Request F -
CVE-2026-102784
Joomla Extension - balbooa.com - CSRF in language installati -
CVE-2026-62142
WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forger -
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced -
CVE-2026-106216
Chrome Android CSRF漏洞（<155.0.8059.39）
V. Comments for CVE-2026-66479
No comments yet