CVE-2026-39071
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.
- Published Aug 28, 2026
- CVSS 5.4 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available