First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-66646

MediumCVSS 6.5/10Last modified Oct 22, 2026

Description

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
MyThemeShop	WP Tab Widget	<= 1.2.11

References

https://patchstack.com/database/wordpress/plugin/wp-tab-widget/vulnerability/wordpress-wp-tab-widget-plugin-1-2-11-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Aug 18, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-666476.5Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-666489.8Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.CVE-2026-666499.3Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66659.8The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM clie CVE-2026-666509.8Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.CVE-2026-666516.5Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access CVE-2026-666525.4Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: CVE-2026-666538.1Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.CVE-2026-666546.0Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.CVE-2026-666557.1Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-666568.1Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.CVE-2026-666578.1Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

CVE-2026-66646: Medium severity, CVSS 6.5 | Vulnix