What is the CVSS score of CVE-2026-66705?

CVE-2026-66705 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Facebook for WordPress are affected by CVE-2026-66705?

The Facebook for WordPress plugin versions 5.2.1 and earlier contain an unauthenticated cross-site scripting vulnerability affecting any organization deploying this widely used component, enabling…

How to fix or mitigate CVE-2026-66705?

Within 24 hours, audit all WordPress installations to identify instances of Facebook for WordPress plugin version 5.2.1 or earlier and disable or remove the plugin immediately if operational requirements permit. Within 7 days, deploy Web Application Firewall (WAF) rules to block XSS-pattern requests targeting this plugin's endpoints, conduct a forensic review of access and authentication logs for exploitation attempts, and notify affected users to reset passwords if the plugin remains in use. Within 30 days, subscribe to Automattic security advisories for a vendor-released patch, test any available update against your WordPress environment in staging, and deploy the patch to production upon successful validation.

Facebook for WordPress CVE-2026-66705

EUVD-2026-53908 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-w2c9-5gcq-r387

WordPress XSS Wordpress Plugin Facebook Facebook For Wordpress

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS requires victim interaction (UI:R) and shifts scope to the browser context (S:C); availability impact is omitted as XSS does not meaningfully disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:39 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.

AnalysisAI

Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.

Technical ContextAI

The Facebook for WordPress plugin (CPE: cpe:2.3:a:facebook:facebook_for_wordpress:*:*:*:*:*:*:*:*) integrates Facebook Pixel and conversion-tracking functionality into WordPress sites, processing externally-supplied parameters and rendering them in page output. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of attacker-controlled input before it is written into the HTML response. The CVSS Scope:Changed (S:C) metric is technically significant: it confirms that the impact boundary shifts from the vulnerable WordPress server component into the victim's browser trust domain, a defining characteristic of reflected or stored XSS where the payload executes under the origin of the target site rather than the attacker's.

RemediationAI

Update the Facebook for WordPress plugin to the version specified as fixed in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/official-facebook-pixel/vulnerability/wordpress-facebook-for-wordpress-plugin-5-2-1-cross-site-scripting-xss-vulnerability) as the primary remediation; the exact patched version number was not confirmed in the available data and must be verified before deploying. If an immediate plugin update is not feasible, deploying a WAF rule to filter common XSS patterns (script tags, javascript: URIs, inline event handlers) on the affected plugin endpoints can reduce exposure, though WAF bypass techniques are well-documented and this is not a substitute for patching. Sites that no longer use Facebook Pixel tracking can deactivate and remove the plugin entirely, eliminating the attack surface at the cost of losing conversion-tracking functionality. Implementing a strict Content-Security-Policy header (script-src 'self') at the server level limits the damage from any XSS execution by restricting which origins can load scripts, even if a bypass of the input filter is achieved.