What is the CVSS score of CVE-2026-66440?

CVE-2026-66440 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WPIDE are affected by CVE-2026-66440?

WPIDE, a WordPress file management and code editor plugin, contains an unauthenticated cross-site scripting vulnerability (CVE-2026-66440, CVSS 7.1) that allows remote attackers to execute malicious…

How to fix or mitigate CVE-2026-66440?

Within 24 hours, immediately identify and disable WPIDE version 3.5.7 or earlier across all WordPress installations; no public exploit has been identified at time of analysis, but the unauthenticated nature of this vulnerability makes urgent containment critical. Within 7 days, conduct a security review of administrator accounts for unauthorized activity and audit file modifications for evidence of compromise. Within 30 days, monitor xplodedthemes for a security patch release and upgrade immediately upon availability; implement Web Application Firewall (WAF) rules to detect and block XSS payloads targeting this plugin as an interim measure.

WPIDE CVE-2026-66440

EUVD-2026-53882 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-jv46-h5f9-888h

WordPress XSS Wordpress Plugin Wpide File Manager Code Editor Xplodedthemes

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

PR:N confirmed by unauthenticated injection; S:C and C:L/I:L reflect script execution in victim browser context; A:N as no availability mechanism is described.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:44 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPIDE - File Manager & Code Editor <= 3.5.7 versions.

AnalysisAI

Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

WPIDE is a WordPress plugin developed by xplodedthemes that exposes file manager and in-browser code editor functionality, typically accessible within the WordPress admin panel or via publicly reachable endpoints (CPE: cpe:2.3:a:xplodedthemes:wpide_-_file_manager_&_code_editor:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored in HTML output without adequate escaping or sanitization. Given the PR:N metric in the CVSS vector, the vulnerable injection point is reachable without any prior authentication. The S:C (scope changed) metric confirms the injected script escapes the plugin's own origin/context and executes in the victim's browser session, a hallmark of reflected or stored XSS that achieves cross-context script execution.

RemediationAI

Upstream fix availability has not been independently confirmed from the provided input data - no exact patched version number is present in the references. Site administrators should immediately consult the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpide/vulnerability/wordpress-wpide-file-manager-code-editor-plugin-3-5-7-cross-site-scripting-xss-vulnerability to verify whether a patched release beyond 3.5.7 has been published and apply it. If no patch is yet available, the most effective compensating control is to deactivate or remove the WPIDE plugin entirely, which eliminates the attack surface at the cost of losing in-WordPress file management and code editing capabilities. As a partial secondary control, deploying a WAF rule (e.g., via Wordfence or Cloudflare) that strips or blocks reflected XSS patterns in requests to WordPress plugin endpoints can reduce risk but should not substitute for patching, since stored XSS variants bypass request-layer filtering. Restricting access to the WordPress admin panel by IP allowlist reduces the pool of potential victims for admin-targeted XSS delivery.