CVE-2026-66669

HighCVSS 8.8/10Last modified Nov 7, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
SupluginsSuperb Addons: Blocks, Patterns &amp; Theme Designer<= 4.2.4

References

Timeline

Published
Nov 7, 2026
Last modified
Nov 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-66674.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the aCVE-2026-666708.1Unauthenticated Local File Inclusion in Måne <= 1.7 versions.CVE-2026-666718.1Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.CVE-2026-666729.8Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-666737.1Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-666745.6Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-666756.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors motors-car-dealeCVE-2026-666765.3Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-666777.6Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-666784.3Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.CVE-2026-666796.5Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-66687.5Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial o
CVE-2026-66669: High severity, CVSS 8.8 | Vulnix