CVE-2026-66643

Contributor-level XSS in Wufoo Shortcode plugin (≤1.55) allows low-privileged users to inject scripts rendered in other users' browsers. CVSS 6.5 (medium) reflects network attack vector, low complexity, and required user interaction. Patchstack is the CNA; update to a fixed version beyond 1.55. N...