What is the CVSS score of CVE-2026-66683?

CVE-2026-66683 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Custom CSS and JavaScript CVE-2026-66683

EUVD-2026-53894 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-06 Patchstack

GHSA-2qq4-p3mf-f362

WordPress Information Disclosure Wordpress Plugin Custom Css And Javascript

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no auth or interaction required; impact limited to partial confidentiality loss, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:12 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is the 'Custom CSS and JavaScript' WordPress plugin developed by WP Zone, identified by CPE cpe:2.3:a:wp_zone:custom_css_and_javascript:*:*:*:*:*:*:*:* for all versions through 2.0.16. CWE-201 describes a root cause where an application inserts sensitive data into outbound responses - in this context, plugin API or AJAX endpoints likely return stored CSS/JavaScript snippets, configuration values, or metadata to unauthenticated HTTP requests. WordPress plugins of this type often expose REST API or admin-ajax endpoints that, if improperly access-controlled, can leak content intended only for authenticated administrators, including custom code that may embed API keys, internal URLs, or other configuration secrets.

RemediationAI

The primary remediation is to update the Custom CSS and JavaScript plugin to a version above 2.0.16 if a patched release has been published by WP Zone; however, no specific fixed version number is confirmed in the available source data - consult the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/custom-css-and-javascript/vulnerability/wordpress-custom-css-and-javascript-plugin-2-0-16-sensitive-data-exposure-vulnerability for the current patched release. As a compensating control pending patch availability, administrators should immediately audit their stored custom CSS and JavaScript for embedded secrets such as API keys, credentials, or internal endpoint URLs, and rotate any that exist - removing secrets from plugin-managed code eliminates the practical impact of the exposure. Additionally, a Web Application Firewall rule that restricts unauthenticated access to the plugin's REST API or admin-ajax endpoints can reduce exposure surface, though this may break front-end functionality if the plugin serves content publicly.