CVE-2026-66637: Featured Video Plus XSS Vulnerability

CVE-2026-66637 Overview

CVE-2026-66637 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Featured Video Plus WordPress plugin in versions 2.3.3 and earlier. The flaw allows authenticated users with the Contributor role to inject malicious JavaScript into plugin-controlled fields. When another user renders the affected content, the injected script executes in their browser session under the site's origin. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browsers of administrators or visitors viewing affected posts, enabling session theft, forced actions, and content defacement.

Affected Products

Featured Video Plus WordPress plugin, versions <= 2.3.3
WordPress sites permitting Contributor-level accounts
Sites that render featured video content generated by the plugin

Discovery Timeline

2026-08-18 - CVE-2026-66637 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66637

Vulnerability Analysis

The Featured Video Plus plugin fails to correctly neutralize user-supplied input before rendering it inside HTML output. A user holding the Contributor role can supply crafted markup or script payloads through plugin-controlled fields tied to featured video embedding. The unsanitized input is stored and later rendered without sufficient output encoding.

Because the payload is stored, exploitation does not require repeated attacker action. Any user visiting the affected content triggers script execution in their session context. The change of scope in the CVSS vector reflects impact beyond the vulnerable component, since the executed script runs in the visitor's browser trust boundary.

Exploitation requires user interaction, typically an administrator or editor previewing or reviewing the contributor's post. Once executed, attacker-supplied JavaScript can access session cookies not marked HttpOnly, submit forms on behalf of the victim, or pivot to administrative actions via the WordPress REST API.

Root Cause

The root cause is missing or insufficient output escaping on fields writable by contributors. WordPress expects plugins to escape late using functions such as esc_html(), esc_attr(), or wp_kses(). Featured Video Plus does not apply adequate sanitization for Contributor-role input, permitting HTML and script contexts to remain intact through render.

Attack Vector

The vector is network-based via authenticated HTTP requests to a WordPress site running the vulnerable plugin. An attacker registers or compromises a Contributor account, submits a post that includes a malicious payload in a plugin-controlled field, and waits for a privileged user to view the content. See the Patchstack advisory for Featured Video Plus for additional technical detail.

Detection Methods for CVE-2026-66637

Indicators of Compromise

Post revisions authored by Contributor accounts containing <script> tags, on* event handlers, or javascript: URIs in featured video fields
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after reviewing contributor submissions
New administrator accounts or altered user roles created without corresponding admin login events
WordPress audit log entries showing Contributor edits followed by privileged REST API calls from the same session

Detection Strategies

Scan the wp_posts and wp_postmeta tables for HTML event handlers and script tags stored in Featured Video Plus metadata keys
Deploy Content Security Policy (CSP) reporting to catch inline script violations originating from post views
Review WordPress REST API access logs for privilege changes correlated with post preview activity

Monitoring Recommendations

Alert on creation or modification of Administrator or Editor accounts outside of change windows
Monitor plugin version inventory across WordPress fleets and flag hosts running Featured Video Plus <= 2.3.3
Log and review Contributor-authored post content for HTML that bypasses the expected editor sanitization

How to Mitigate CVE-2026-66637

Immediate Actions Required

Update Featured Video Plus to a version later than 2.3.3 once released, or remove the plugin if no patched version is available
Audit existing Contributor accounts and remove any that are unnecessary or unverified
Purge stored post content authored by contributors for injected script payloads before privileged users open it

Patch Information

No fixed version is listed in the referenced advisory at the time of writing. Consult the Patchstack advisory for the current remediation status and upgrade guidance.

Workarounds

Restrict who can hold the Contributor role and require administrator approval before post preview
Deploy a Web Application Firewall (WAF) rule blocking <script>, onerror=, and javascript: patterns in plugin request parameters
Enforce a strict Content Security Policy that disallows inline scripts and unknown external script sources
Temporarily deactivate Featured Video Plus until a patched release is confirmed

bash

# Example: list sites running the vulnerable plugin version via WP-CLI
wp plugin list --field=name,version | grep featured-video-plus

# Deactivate the plugin as a temporary workaround
wp plugin deactivate featured-video-plus