CVE-2026-66479
Received Received - Intake

CSRF to Stored XSS in WPComplete

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Patchstack

Description
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-66479
EUVD
EUVD-2026-94929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Liquid Web / StellarWP WPComplete 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress WPComplete plugin versions 2.9.5.6 and below. It allows attackers to trick logged-in users into performing unintended actions, such as changing passwords or making purchases, by exploiting user interaction like clicking a malicious link.

Detection Guidance

This vulnerability can be detected by checking the installed version of the WPComplete plugin. If the version is 2.9.5.6 or below, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or check the plugin details in the WordPress admin panel.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your consent, such as modifying account settings, making unauthorized purchases, or changing passwords. This requires you to interact with a malicious link or page while logged in.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. However, if exploited, it could lead to unauthorized actions like password changes or data modifications, which may violate data integrity or access control requirements under these regulations.

Mitigation Strategies

Immediately update the WPComplete plugin to version 2.9.5.7 or later. If updating is not possible, seek assistance from a hosting provider or web developer. Enable auto-updates for vulnerable plugins if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart