CVE-2026-39071

Spiffy Plugin for WordPress, prior to version 5.0.9 , is vulnerable to Stored Cross-Site Scripting (XSS) in the Event Title field . An authenticated attacker holding the lowest-privilege role (contributor ) can inject malicious scripts that, when viewed by other users, may redirect them to a mali...

CVE-2026-39071

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67900

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...