CVE-2026-66646

The WP Tab Widget versions up to 1.2.11 are vulnerable to a Contributor Cross Site Scripting (XSS) flaw, allowing attackers to inject malicious scripts into web pages viewed by users with certain permissions. This vulnerability could lead to unauthorized actions being performed on behalf of users or the exposure of sensitive information. Organizations using this plugin should prioritize remediation to protect against potential exploitation, especially those with user-generated content features.