CVE-2026-66479 in WPComplete Plugin
Summary
by MITRE • 10/08/2026
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The reported security advisory contains a significant technical contradiction that requires immediate clarification for accurate risk assessment and remediation planning. The title explicitly identifies the vulnerability as Cross-Site Request Forgery (CSRF), which is an attack vector where unauthorized commands are transmitted from a user that the web application trusts. However, the description text states that this issue allows Stored Cross-Site Scripting (XSS). These are two distinct classes of vulnerabilities with different root causes and mitigation strategies. CSRF exploits the trust a site has in a user's browser to perform actions on their behalf without their knowledge, typically by tricking them into submitting a malicious form or clicking a link. In contrast, Stored XSS involves injecting malicious scripts into content that is then permanently stored on the target server, such as in a database, and subsequently served to other users when they access the affected page. It is highly probable that the vulnerability description contains an error, likely confusing the attack vector with the impact or mislabeling the flaw type entirely. If the issue truly allows Stored XSS, it falls under CWE-79: Improper Neutralization of Input During Web Page Generation and maps to ATT&CK technique T1059.007: JavaScript. This would imply that an attacker can inject client-side script into web pages viewed by other users, leading to session hijacking, defacement, or redirection to malicious sites. Conversely, if the issue is indeed CSRF as stated in the title, it falls under CWE-352 and maps to ATT&CK technique T1089: Disabling Security Tools or more commonly T1566.002: Spearphishing Link, depending on how the request is triggered. Given the context of WordPress plugins like WPComplete, which often handle user input for settings or content management, both vulnerabilities are plausible but require different technical approaches to fix. For a potential XSS flaw, mitigation involves strict output encoding and input validation using libraries that escape special characters such as <, >, &, ", and '. For CSRF, the solution requires implementing anti-CSRF tokens in all state-changing requests and verifying the Origin or Referer headers. Organizations should treat this advisory with caution until clarified by Liquid Web or StellarWP, as applying incorrect patches based on a mislabeled vulnerability could leave systems exposed to either attack vector. Immediate steps include reviewing recent code changes in WPComplete versions up to 2.9.5.6 for any unsanitized input fields that render HTML and ensuring all forms use unique, unpredictable tokens tied to the user session.