CVE-2026-39071
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 28, 2026
Vendor
unknown
Description
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.