What is the CVSS score of CVE-2026-66685?

CVE-2026-66685 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Featured Video Plus CVE-2026-66685

EUVD-2026-53896 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-06 Patchstack

GHSA-qxp8-27xq-3fvx

WordPress Information Disclosure Wordpress Plugin Alex Featured Video Plus

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no auth or user interaction; confidentiality limited to partial data exposure; no integrity or availability impact per CWE-201 class.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:05 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Featured Video Plus is a WordPress plugin (CPE: cpe:2.3:a:alex:featured_video_plus:*:*:*:*:*:*:*:*) that extends WordPress sites with video embedding and management capabilities. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes data in HTTP responses that should be withheld from unauthenticated callers - commonly manifesting as exposed API keys, internal paths, configuration details, or user-related metadata leaking through plugin-generated output or REST API endpoints. The CVSS AC:L rating indicates this is consistently reproducible without any special race conditions or environmental tuning.

RemediationAI

The primary remediation is to update the Featured Video Plus plugin to a version beyond 2.3.3; however, an exact patched release version is not independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/featured-video-plus/vulnerability/wordpress-featured-video-plus-plugin-2-3-3-sensitive-data-exposure-vulnerability and the WordPress plugin repository for the latest available release. If immediate patching is not possible, a compensating control is to deactivate the plugin entirely until a patched version is available, which eliminates the attack surface at the cost of losing video management functionality. Alternatively, restrict access to WordPress plugin endpoints via WAF rules or web server configuration to limit exposure to trusted IP ranges, though this is a partial mitigation since the vulnerability requires no authentication and is triggered by normal HTTP requests.